Edit tour

Linux Analysis Report
3kMnPQIVHR.elf

Overview

General Information

Sample name:	3kMnPQIVHR.elf renamed because original name is a hash value
Original sample name:	3b72798211c3a5312ddc188a8b9fc23a.elf
Analysis ID:	1540788
MD5:	3b72798211c3a5312ddc188a8b9fc23a
SHA1:	8212d1b8ffe7e227e447c0590085f207779fde77
SHA256:	44d76874446f3e2bc99b96b99148f33872639bc15eb33f3ff1f64d5c1fd636cb
Tags:	32elfmiraisparc
Infos:

Detection

Mirai

Score:	76
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Sample tries to kill multiple processes (SIGKILL)

Creates hidden files and/or directories

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Sample has stripped symbol table

Sample tries to kill a process (SIGKILL)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1540788
Start date and time:	2024-10-24 06:57:41 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 21s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	3kMnPQIVHR.elf renamed because original name is a hash value
Original Sample Name:	3b72798211c3a5312ddc188a8b9fc23a.elf
Detection:	MAL
Classification:	mal76.spre.troj.linELF@0/51@2/0

Runtime Messages

Command:	/tmp/3kMnPQIVHR.elf
PID:	5555
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	lzrd cock fest"/proc/"/exe
Standard Error:

Process Tree

system is lnxubuntu20

3kMnPQIVHR.elf (PID: 5555, Parent: 5474, MD5: 7dc1c0e23cd5e102bb12e5c29403410e) Arguments: /tmp/3kMnPQIVHR.elf

3kMnPQIVHR.elf New Fork (PID: 5557, Parent: 5555)

3kMnPQIVHR.elf New Fork (PID: 5558, Parent: 5555)

3kMnPQIVHR.elf New Fork (PID: 5561, Parent: 5555)

xfce4-panel New Fork (PID: 5565, Parent: 3172)

wrapper-2.0 (PID: 5565, Parent: 3172, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"

xfce4-panel New Fork (PID: 5566, Parent: 3172)

wrapper-2.0 (PID: 5566, Parent: 3172, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"

xfce4-panel New Fork (PID: 5567, Parent: 3172)

wrapper-2.0 (PID: 5567, Parent: 3172, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"

xfce4-panel New Fork (PID: 5569, Parent: 3172)

wrapper-2.0 (PID: 5569, Parent: 3172, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"

xfce4-panel New Fork (PID: 5570, Parent: 3172)

wrapper-2.0 (PID: 5570, Parent: 3172, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"

xfce4-panel New Fork (PID: 5571, Parent: 3172)

wrapper-2.0 (PID: 5571, Parent: 3172, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"

systemd New Fork (PID: 5618, Parent: 1)

logrotate (PID: 5618, Parent: 1, MD5: ff9f6831debb63e53a31ff8057143af6) Arguments: /usr/sbin/logrotate /etc/logrotate.conf

systemd New Fork (PID: 5619, Parent: 1)

install (PID: 5619, Parent: 1, MD5: 55e2520049dc6a62e8c94732e36cdd54) Arguments: /usr/bin/install -d -o man -g man -m 0755 /var/cache/man

systemd New Fork (PID: 5677, Parent: 1)

find (PID: 5677, Parent: 1, MD5: b68ef002f84cc54dd472238ba7df80ab) Arguments: /usr/bin/find /var/cache/man -type f -name *.gz -atime +6 -delete

systemd New Fork (PID: 5680, Parent: 1)

mandb (PID: 5680, Parent: 1, MD5: 1dda5ea0027ecf1c2db0f5a3de7e6941) Arguments: /usr/bin/mandb --quiet

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
3kMnPQIVHR.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
3kMnPQIVHR.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xc958:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc96c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc980:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc994:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcaac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcac0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcad4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcae8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
3kMnPQIVHR.elf	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xceb8:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64

Memory Dumps

Source	Rule	Description	Author	Strings
5555.1.00007f2050011000.00007f205001f000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5555.1.00007f2050011000.00007f205001f000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xc958:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc96c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc980:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc994:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcaac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcac0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcad4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcae8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5555.1.00007f2050011000.00007f205001f000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xceb8:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
5558.1.00007f2050011000.00007f205001f000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5558.1.00007f2050011000.00007f205001f000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xc958:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc96c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc980:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc994:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcaac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcac0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcad4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcae8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5558.1.00007f2050011000.00007f205001f000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xceb8:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: 3kMnPQIVHR.elf PID: 5555	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: 3kMnPQIVHR.elf PID: 5555	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x130:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x144:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x158:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x180:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x194:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: 3kMnPQIVHR.elf PID: 5555	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x526:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: 3kMnPQIVHR.elf PID: 5558	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: 3kMnPQIVHR.elf PID: 5558	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x2ba9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2bbd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2bd1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2be5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2bf9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2c0d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2c21:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2c35:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2c49:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2c5d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2c71:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2c85:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2c99:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2cad:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2cc1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2cd5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2ce9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2cfd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2d11:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2d25:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2d39:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: 3kMnPQIVHR.elf PID: 5558	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x3067:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Click to see the 7 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 3kMnPQIVHR.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: 3kMnPQIVHR.elf	Virustotal: Detection: 64%			Perma Link
Source: 3kMnPQIVHR.elf	ReversingLabs: Detection: 65%

Source: global traffic

TCP traffic: 192.168.2.14:45972 -> 79.133.46.243:3778

Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.243
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.243
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.243
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.243
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.243
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.243
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.243
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.243
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.243
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.243
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.243
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.243
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.243
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.243
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.243
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.243
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.243
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.243
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.243
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.243
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.243
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.243
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.243
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.243
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.243
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.243
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.243
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.243
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.243
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.243
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.243
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.243
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.243
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.243
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.243
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.243
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.243
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.243
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.243
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.243
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.243
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.243
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.243
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.243
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.243
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.243
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.243
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.243
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.243
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.243

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

System Summary

Malicious sample detected (through community Yara rule)

Source: 3kMnPQIVHR.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 3kMnPQIVHR.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5555.1.00007f2050011000.00007f205001f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5555.1.00007f2050011000.00007f205001f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5558.1.00007f2050011000.00007f205001f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5558.1.00007f2050011000.00007f205001f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: 3kMnPQIVHR.elf PID: 5555, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: 3kMnPQIVHR.elf PID: 5555, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: 3kMnPQIVHR.elf PID: 5558, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: 3kMnPQIVHR.elf PID: 5558, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	SIGKILL sent: pid: 3129, result: successful	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	SIGKILL sent: pid: 3184, result: successful	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	SIGKILL sent: pid: 3187, result: successful	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	SIGKILL sent: pid: 3188, result: successful	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	SIGKILL sent: pid: 3189, result: successful	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	SIGKILL sent: pid: 3190, result: successful	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	SIGKILL sent: pid: 3193, result: successful	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	SIGKILL sent: pid: 3207, result: successful	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	SIGKILL sent: pid: 3215, result: successful	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	SIGKILL sent: pid: 3235, result: successful	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	SIGKILL sent: pid: 5565, result: successful	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	SIGKILL sent: pid: 5566, result: successful	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	SIGKILL sent: pid: 5567, result: successful	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	SIGKILL sent: pid: 5569, result: successful	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	SIGKILL sent: pid: 5570, result: successful	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	SIGKILL sent: pid: 5571, result: successful	Jump to behavior

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	SIGKILL sent: pid: 3129, result: successful	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	SIGKILL sent: pid: 3184, result: successful	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	SIGKILL sent: pid: 3187, result: successful	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	SIGKILL sent: pid: 3188, result: successful	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	SIGKILL sent: pid: 3189, result: successful	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	SIGKILL sent: pid: 3190, result: successful	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	SIGKILL sent: pid: 3193, result: successful	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	SIGKILL sent: pid: 3207, result: successful	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	SIGKILL sent: pid: 3215, result: successful	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	SIGKILL sent: pid: 3235, result: successful	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	SIGKILL sent: pid: 5565, result: successful	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	SIGKILL sent: pid: 5566, result: successful	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	SIGKILL sent: pid: 5567, result: successful	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	SIGKILL sent: pid: 5569, result: successful	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	SIGKILL sent: pid: 5570, result: successful	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	SIGKILL sent: pid: 5571, result: successful	Jump to behavior

Source: 3kMnPQIVHR.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 3kMnPQIVHR.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5555.1.00007f2050011000.00007f205001f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5555.1.00007f2050011000.00007f205001f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5558.1.00007f2050011000.00007f205001f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5558.1.00007f2050011000.00007f205001f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: 3kMnPQIVHR.elf PID: 5555, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: 3kMnPQIVHR.elf PID: 5555, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: 3kMnPQIVHR.elf PID: 5558, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: 3kMnPQIVHR.elf PID: 5558, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16

Source: classification engine

Classification label: mal76.spre.troj.linELF@0/51@2/0

Source: /usr/sbin/logrotate (PID: 5618)	Directory: //.	Jump to behavior
Source: /usr/bin/find (PID: 5677)	Directory: //.	Jump to behavior
Source: /usr/bin/mandb (PID: 5680)	Directory: /var/cache/man/.manpath	Jump to behavior

Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/3760/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/3761/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/2672/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/1583/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/3244/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/3120/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/3361/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/3759/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/3239/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/1577/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/1610/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/512/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/1299/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/3235/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/514/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/5537/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/519/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/3877/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/5538/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/2946/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/917/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/3134/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/1593/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/3011/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/5391/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/3094/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/3406/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/1589/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/3129/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/1588/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/3402/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/3125/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/3246/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/3245/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/767/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/888/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/3762/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/801/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/769/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/803/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/806/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/807/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/928/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/2956/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/5561/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/5565/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/3420/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/490/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/3142/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/1635/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/1633/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/1599/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/3139/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/1873/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/1630/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/3412/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/657/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/658/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/659/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/418/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/419/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/1639/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/1638/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/5570/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/5571/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/3673/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/3398/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/1371/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/3392/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/780/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/660/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/661/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/782/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/1369/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/3304/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/3425/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/785/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/1642/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/940/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/941/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/1640/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/3147/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/3268/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/1364/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/5566/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/548/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/5567/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/5569/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/1647/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/2991/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/1383/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/1382/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/1381/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/791/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/671/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/794/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/1655/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/2986/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/795/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/674/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/1653/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/797/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/2983/cmdline	Jump to behavior
Source: /tmp/3kMnPQIVHR.elf (PID: 5557)	File opened: /proc/3159/cmdline	Jump to behavior

Source: /tmp/3kMnPQIVHR.elf (PID: 5555)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/find (PID: 5677)	Queries kernel information via 'uname':			Jump to behavior

Source: 5680.35.dr	Binary or memory string: -9915837702310A--gzvmware kernel module
Source: 5680.35.dr	Binary or memory string: -1116261022170A--gzQEMU User Emulator
Source: 5680.35.dr	Binary or memory string: qemu-or1k
Source: 5680.35.dr	Binary or memory string: qemu-riscv64
Source: 5680.35.dr	Binary or memory string: qemu-arm
Source: 5680.35.dr	Binary or memory string: (qemu
Source: 5680.35.dr	Binary or memory string: qemu-tilegx
Source: 5680.35.dr	Binary or memory string: qemu-hppa
Source: 5680.35.dr	Binary or memory string: q{rqemu%
Source: 5680.35.dr	Binary or memory string: )qemu
Source: 5680.35.dr	Binary or memory string: vmware-toolbox-cmd
Source: 5680.35.dr	Binary or memory string: qemu-ppc
Source: 5680.35.dr	Binary or memory string: Tqemu9
Source: 3kMnPQIVHR.elf, 5555.1.00007ffea6fbd000.00007ffea6fde000.rw-.sdmp, 3kMnPQIVHR.elf, 5558.1.00007ffea6fbd000.00007ffea6fde000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sparc
Source: 5680.35.dr	Binary or memory string: qemu-aarch64_be
Source: 5680.35.dr	Binary or memory string: 0qemu9
Source: 5680.35.dr	Binary or memory string: qemu-sparc64
Source: 5680.35.dr	Binary or memory string: qemu-mips64
Source: 5680.35.dr	Binary or memory string: vV:qemu9
Source: 5680.35.dr	Binary or memory string: <prezip-bin-1116269780060A--gzprefix zip delta word list compressor/decompressornameif-8815490444730A--gzname network interfaces based on MAC addressesxdg-user-dirs-update-1115483406210A--gzUpdate XDG user dir configurationip-link-8815816145190A--gznetwork device configurationhpsa-4415812813670A--gzHP Smart Array SCSI driverhd4-4415812813670A--gzMFM/IDE hard disk devicessane-canon630u-5516003468200A--gzSANE backend for the Canon 630u USB flatbed scannersg_copy_results-8815825816070A--gzsend SCSI RECEIVE COPY RESULTS command (XCOPY related)grub-macbless-8816214898500A--gzbless a mac file/directoryntfstruncate-8815568625640A-tgztruncate a file on an NTFS volumelessfile-1115936459130B--gz"input preprocessor" for less.sane-artec-5516003468200A--gzSANE backend for Artec flatbed scannersrmdir-1115676799200A--gzremove empty directoriessystemd-networkd-wait-online.service-8816268940210A--gzWait for network to come onlinemkfs.ntfs-8815568625640B-tgzcreate an NTFS file systemsg_inq-8815825816070A--gzissue SCSI INQUIRY command and/or decode its responseradattr.so-8815955079440Cpppd-radattr-gzc_rehash-1ssl116164130370B--gzCreate symbolic links to files named by the hash valuestc-htb-8815816145190A--gzHierarchy Token Bucketgvfs-open-1115868766090A--gzsg_rbuf-8815825816070A--gzreads data using SCSI READ BUFFER commandglib-compile-schemas-1116155671180A--gzGSettings schema compileropenssl-srp-1ssl116164130370B--gzmaintain SRP password fileopenssl-rehash-1ssl116164130370B--gzCreate symbolic links to files named by the hash valueslibvmtools-3315837702310A--gzvmware shared librarypasswd5-5515906478670A--gzthe password filenet::dbus::dumperNet::DBus::Dumper3pm315773746310A--gzStringify Net::DBus objects suitable for printingsane-hp4200-5516003468200A--gzSANE backend for Hewlett-Packard 4200 scannersposixoptions-7715812813670A--gzoptional parts of the POSIX standardnetworkmanager.confNetworkManager.conf5516002723180A--gzNetworkManager configuration fileownership-8815771238010A--gzCompaq ownership tag retrieveroakdecode-1115804162510A--gzDecode an OAKT printer stream into human readable form.gvfs-save-1115868766090A--gzmkfs.minix-8815953177680A--gzmake a Minix filesystemuri7-7715812813670A--gzuniform resource identifier (URI), including a URL or URNedit-1115714399500B--gzexecute programs via entries in the mailcap filegit-diff-files-1116148628880A--gzCompares files in the working tree and the index.ldaprc-5516136581350Cldap.conf-gzpactl-1116219586470A--gzControl a running PulseAudio sound servertempfile-1115756848240A--gzcreate a temporary file in a safe mannerhp-check-1115857238880A--gzDependency/Vers
Source: 5680.35.dr	Binary or memory string: qemu-ppc64le
Source: 5680.35.dr	Binary or memory string: <glib::param::uint64Glib::Param::UInt643pm315820097650A--gzWrapper for uint64 parameters in GLibx86_64-linux-gnu-ld.gold-1116112426130B--gzThe GNU ELF linkerprinter-profile-1115804162510A--gzProfile using X-Rite ColorMunki and Argyll CMSwhoami-1115676799200A--gzprint effective useridgrub-fstest-1116214898500A--gzdebug tool for GRUB filesystem driversxdg-user-dir-1115483406210A--gzFind an XDG user dirkmodsign-1115569251480A--gzKernel module signing toolsensible-editor-1115739932820A--gzsensible editing, paging, and web browsingminesMines6615854478170Cgnome-mines-gzinputattach-1115708189280A--gzattach a serial line to an input-layer devicegapplication-1116155671180A--gzD-Bus application launcherip-tunnel-8815816145190A--gztunnel configurationkoi8rxterm-1116140167530A--gzX terminal emulator for KOI8-R environmentsfoo2hiperc-wrapper-1115804162510A-tgzConvert Postscript into a HIPERC printer streamcryptsetup-reencrypt-8816002888050A--gztool for offline LUKS device re-encryptionsyndaemon-1115861716810A--gza program that monitors keyboard activity and disables the touchpad when the keyboard is being used.gslj-1115980290200B--gzFormat and print text for LaserJet printer using ghostscriptfile2brl-1115757179490A--gzTranslate an xml or a text file into an embosser-ready braille filexfdesktop-settings-1115793419820A--gzDesktop settings for Xfceua-1115856013570B--gzManage Ubuntu Advantage services from Canonicallatin4-7715812813670B--gzISO 8859-4 character set encoded in octal, decimal, and hexadecimalsane-genesys-5516003468200A--gzSANE backend for GL646, GL841, GL843, GL847 and GL124 based USB flatbed scannerspdftohtml-1115853266670A--gzprogram to convert PDF files into HTML, XML and PNG imagesbluetooth-sendto-1116015653360A--gzGTK application for transferring files over Bluetoothqemu-ppc64-1116261022170B--gzQEMU User Emulatorcache_metadata_size-8815811608350A--gzEstimate the size of the metadata device needed for a given configuration.net::dbus::exporterNet::DBus::Exporter3pm315773746310A--gzExport object methods and signals to the bussane-pint-5516003468200A--gzSANE backend for scanners that use the PINT device driverbpf-helpers7-7715812813670A--gzlist of eBPF helper functionsfull-4415812813670A--gzalways full devicelogin-1115906478670A--gzbegin session on the systemcups-snmp-8815877390340A--gzcups snmp backend (deprecated)ordchr-3am315728089600A--gzconvert characters to strings and vice versasosreport-1116092694050A--gzCollect and package diagnostic and support datatop-1115827827270A--gzdisplay Linux processesuri::_punycodeURI::_punycode3pm315811897880A--gzencodes Unicode string in Punycodettytty4tty1systemd-localed-881626894021
Source: 5680.35.dr	Binary or memory string: vmware
Source: 5680.35.dr	Binary or memory string: qemu-cris
Source: 5680.35.dr	Binary or memory string: libvmtools
Source: 5680.35.dr	Binary or memory string: qemu-m68k
Source: 5680.35.dr	Binary or memory string: qemu-xtensa
Source: 5680.35.dr	Binary or memory string: 9qemu
Source: 5680.35.dr	Binary or memory string: qemu-sh4
Source: 5680.35.dr	Binary or memory string: Vqemu m
Source: 5680.35.dr	Binary or memory string: .qemu{
Source: 5680.35.dr	Binary or memory string: qemu-ppc64abi32
Source: 5680.35.dr	Binary or memory string: qemu-ppc64
Source: 5680.35.dr	Binary or memory string: qemu-i386
Source: 5680.35.dr	Binary or memory string: qemu-x86_64
Source: 3kMnPQIVHR.elf, 5555.1.0000558b9cb75000.0000558b9cbfa000.rw-.sdmp, 3kMnPQIVHR.elf, 5558.1.0000558b9cb75000.0000558b9cbfa000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sparc
Source: 5680.35.dr	Binary or memory string: H~6\nqemu*q
Source: 3kMnPQIVHR.elf, 5555.1.0000558b9cb75000.0000558b9cbfa000.rw-.sdmp, 3kMnPQIVHR.elf, 5558.1.0000558b9cb75000.0000558b9cbfa000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/sparc
Source: 5680.35.dr	Binary or memory string: @qemu
Source: 5680.35.dr	Binary or memory string: Fqqemu
Source: 5680.35.dr	Binary or memory string: N4qemu
Source: 5680.35.dr	Binary or memory string: ~6\nqemu*q
Source: 5680.35.dr	Binary or memory string: qemu-mips64el
Source: 5680.35.dr	Binary or memory string: &mqemu
Source: 5680.35.dr	Binary or memory string: $qemu
Source: 5680.35.dr	Binary or memory string: qemu-sparc
Source: 5680.35.dr	Binary or memory string: {cqemujC
Source: 5680.35.dr	Binary or memory string: qemu-microblaze
Source: 5680.35.dr	Binary or memory string: qemu-user
Source: 5680.35.dr	Binary or memory string: qemu-aarch64
Source: 5680.35.dr	Binary or memory string: qemu-sh4eb
Source: 5680.35.dr	Binary or memory string: iqemu
Source: 5680.35.dr	Binary or memory string: qemu-mipsel
Source: 5680.35.dr	Binary or memory string: qemuP`
Source: 5680.35.dr	Binary or memory string: hqemu)
Source: 5680.35.dr	Binary or memory string: qemu-alpha
Source: 5680.35.dr	Binary or memory string: qemu-microblazeel
Source: 5680.35.dr	Binary or memory string: \qemu
Source: 5680.35.dr	Binary or memory string: qemu-xtensaeb
Source: 5680.35.dr	Binary or memory string: qemu-mipsn32el
Source: 5680.35.dr	Binary or memory string: SAqemu
Source: 5680.35.dr	Binary or memory string: qemu-mipsn32
Source: 3kMnPQIVHR.elf, 5555.1.00007ffea6fbd000.00007ffea6fde000.rw-.sdmp, 3kMnPQIVHR.elf, 5558.1.00007ffea6fbd000.00007ffea6fde000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-sparc/tmp/3kMnPQIVHR.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/3kMnPQIVHR.elf
Source: 5680.35.dr	Binary or memory string: qemuAU
Source: 5680.35.dr	Binary or memory string: qemu-riscv32
Source: 5680.35.dr	Binary or memory string: qemu-sparc32plus
Source: 5680.35.dr	Binary or memory string: 7,qemu
Source: 5680.35.dr	Binary or memory string: qemu-s390x
Source: 5680.35.dr	Binary or memory string: vmware-checkvm
Source: 5680.35.dr	Binary or memory string: qemu-nios2
Source: 5680.35.dr	Binary or memory string: qemu-armeb
Source: 5680.35.dr	Binary or memory string: -4415868968400A--gzVMware SVGA video driver
Source: 5680.35.dr	Binary or memory string: 7xml::parser::style::streamXML::Parser::Style::Stream3pm315701248990A--gzStream style for XML::Parsersystemd-timedated-8816268940210B--gzTime and date bus mechanismxfce4-keyboard-settings-1115867081120A--gzKeyboard settings for Xfcepygettext2-1115841026830B--gzPython equivalent of xgettext(1)sudoedit-8816110660620B--gzexecute a command as another userintro7-7715812813670A--gzintroduction to overview and miscellany sectionsprof-1115812813670A--gzread and display shared object profiling datadhclient.conf-5516219398220A--gzDHCP client configuration filepam_group-8815953742440A--gzPAM module for group accesssystemd-ask-password-1116268940210A--gzQuery the user for a system passwordupdate-dictcommon-hunspell-8815422954860A--gzrebuild hunspell database and emacsen stuffqemu-nios2-1116261022170B--gzQEMU User Emulatorlwp::useragentLWP::UserAgent3pm315750405830A--gzWeb user agent classgpgcompose-1115838662460A--gzGenerate a stream of OpenPGP packetsecho-1115676799200A--gzdisplay a line of textio::socket::ssl::utilsIO::Socket::SSL::Utils3pm315817106800A--gz- loading, storing, creating certificates and keyscurl-1116268709580A--gztransfer a URLgetcap-8815819434600A--gzexamine file capabilitieszegrep-1115762517060B--gzsearch possibly compressed files for a regular expressiongrub-syslinux2cfg-1116214898500A--gztransform syslinux config into grub.cfgrtc-4415812813670A--gzreal-time clockglib::codegenGlib::CodeGen3pm315820097650A--gzcode generation utilities for Glib-based bindings.wpa_cli-8816146062790A--gzWPA command line clientiso_8859_3-7715812813670B--gzISO 8859-3 character set encoded in octal, decimal, and hexadecimaliso_8859-9-7715812813670A-tgzISO 8859-9 character set encoded in octal, decimal, and hexadecimallvextend-8815816289110A--gzAdd space to a logical volumeresolvectl-1116268940210A--gzResolve domain names, IPV4 and IPv6 addresses, DNS resource records, and services; introspect and reconfigure the DNS resolverchgrp-1115676799200A--gzchange group ownershipsystemd-cgls-1116268940210A--gzRecursively show control group contentspygettext3.8-1113852085880A--gzPython equivalent of xgettext(1)ping4-8815804258830B--gzsend ICMP ECHO_REQUEST to network hostsidmapwb-8816000845410A--gzwinbind ID mapping plugin for cifs-utilsapturl-gtk-8815799493830B--gzgraphical apt-protocol interpreting package installersane-epsonds-5516003468200A--gzSANE backend for EPSON ESC/I-2 scannersgvfs-monitor-file-1115868766090A--gzrstart-1115829564830A--gza sample implementation of a Remote Start clientgit-stage-1116148628880A--gzAdd file contents to the staging areatc-pedit-8815816145190A--gzgeneric packet editor actioniptables-save-881582899
Source: 5680.35.dr	Binary or memory string: I_qemu
Source: 5680.35.dr	Binary or memory string: -1116261022170B--gzQEMU User Emulator
Source: 5680.35.dr	Binary or memory string: -3315837702310A--gzvmware shared library
Source: 5680.35.dr	Binary or memory string: qemu-mips
Source: 5680.35.dr	Binary or memory string: qemuj\
Source: 5680.35.dr	Binary or memory string: {qemuQ&
Source: 5680.35.dr	Binary or memory string: Wgnome-text-editor-111629209547491759146B--gztext editor for the GNOME Desktopx11::protocol::connection::filehandleX11::Protocol::Connection::FileHandle3pm314314075500A--gzPerl module base class for FileHandle-based X11 connectionshtbHTB8815816145190Ctc-htb-gzcifscreds-1116000845410A--gzmanage NTLM credentials in kernel keyringiwconfig-8815490049440A--gzconfigure a wireless network interfaceossl_store-file-7ssl716164130370A--gzThe store 'file' scheme loadertc-stab-8815816145190A--gzGeneric size table manipulationsnotifier-7715877390340A--gzcups notification interfaceqemu-arm-1116261022170B--gzQEMU User EmulatorgemfileGemfile5516263767190Cgemfile2.7-gzglib::object::subclassGlib::Object::Subclass3pm315820097650A--gzregister a perl class as a GObject classnetcat-111612200165426646725B--gzarbitrary TCP and UDP connections and listensdpkg::changelog::parseDpkg::Changelog::Parse3perl315849439740A--gzgeneric changelog parser for dpkg-parsechangelogmpris-proxy-1116243432320A--gzBluetooth mpris-proxybundle-pristine2.7-1116263767190A--gzRestores installed gems to their pristine conditionfsck.ext3-8815816604980B--gzcheck a Linux ext2/ext3/ext4 file systemvolname-1115625752510A--gzreturn volume nameiso-8859-9-7715812813670B--gzISO 8859-9 character set encoded in octal, decimal, and hexadecimalheadhead1HEAD1psd-4415812813670A--gzdriver for SCSI disk driveschrt-1115953177680A--gzmanipulate the real-time attributes of a processvcs-4415812813670A--gzvirtual console memorygit-upload-archive-1116148628880A--gzSend archive back to git-archivenet::dbus::binding::message::errorNet::DBus::Binding::Message::Error3pm315773746310A--gza message encoding a method call errorpkcs11.conf-5516097870510A--gzConfiguration files for PKCS#11 modulessfill-1115227593860A--gzsecure free disk and inode space wiper (secure_deletion toolkit)ldattach-8815953177680A--gzattach a line discipline to a serial linethin_restore-8815811608350A--gzrestore thin provisioning metadata file to device or file.phar.phar7.4-1116254980150B--gzPHAR (PHP archive) command line toolbundle-outdated2.7-1116263767190A--gzList installed gems with newer versions availablemail::addressMail::Address3pm315640244160A--gzparse mail addressesopenssl-ca-1ssl116164130370B--gzsample minimal CA applicationchardet3-1115765858900A--gzuniversal character encoding detectorerb2.7-1116263767190A--gzRuby Templatingchktrust-1115826667350A--gzCheck the trust of a PE executable.sg_raw-8815825816070A--gzsend arbitrary SCSI command to a devicegvfs-trash-1115868766090A--gzintro1-1115812813670A--gzintroduction to user commandsmailcap-5515714399500A--gzmetamail capabilities filegigoloGigolo1gig
Source: 5680.35.dr	Binary or memory string: vmware-xferlogs

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: 3kMnPQIVHR.elf, type: SAMPLE
Source: Yara match	File source: 5555.1.00007f2050011000.00007f205001f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5558.1.00007f2050011000.00007f205001f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 3kMnPQIVHR.elf PID: 5555, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 3kMnPQIVHR.elf PID: 5558, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: 3kMnPQIVHR.elf, type: SAMPLE
Source: Yara match	File source: 5555.1.00007f2050011000.00007f205001f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5558.1.00007f2050011000.00007f205001f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 3kMnPQIVHR.elf PID: 5555, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 3kMnPQIVHR.elf PID: 5558, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Hidden Files and Directories	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
3kMnPQIVHR.elf	65%	Virustotal		Browse
3kMnPQIVHR.elf	66%	ReversingLabs	Linux.Backdoor.Mirai
3kMnPQIVHR.elf	100%	Avira	EXP/ELF.Gafgyt.D

Dropped Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
daisy.ubuntu.com	0%	Virustotal		Browse

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.25	true	false	0%, Virustotal, Browse	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
79.133.46.243	unknown	Germany		203833	AT-FIRSTCOLOAustriaAT	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
79.133.46.243	cZlRw8OG35.elf	Get hash	malicious	Mirai	Browse
	j0GmmzdQRz.elf	Get hash	malicious	Mirai	Browse
	VWpmyBcWBO.elf	Get hash	malicious	Mirai	Browse
	KBW66LEndt.elf	Get hash	malicious	Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	j0GmmzdQRz.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	VWpmyBcWBO.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	zc68fZAjSh.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	KBW66LEndt.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	la.bot.powerpc.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	la.bot.sh4.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	la.bot.arm.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	la.bot.arm6.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	la.bot.mipsel.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	la.bot.m68k.elf	Get hash	malicious	Unknown	Browse	162.213.35.25

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AT-FIRSTCOLOAustriaAT	cZlRw8OG35.elf	Get hash	malicious	Mirai	Browse	79.133.46.243
	j0GmmzdQRz.elf	Get hash	malicious	Mirai	Browse	79.133.46.243
	VWpmyBcWBO.elf	Get hash	malicious	Mirai	Browse	79.133.46.243
	KBW66LEndt.elf	Get hash	malicious	Mirai	Browse	79.133.46.243
	https://sothebys.us.com/ja4DCams2APwoTx4RAl4DCB4GI1AoTxp4RAoTx4DCuctsz01nQ3Et	Get hash	malicious	HTMLPhisher	Browse	79.133.57.143
	LSW51096D32024I.exe	Get hash	malicious	FormBook	Browse	79.133.41.250
	TNS71092E68UI0.vbe	Get hash	malicious	FormBook	Browse	79.133.41.250
	leXVJ63fbD.elf	Get hash	malicious	Gafgyt, Mirai	Browse	79.133.46.138
	QsVZ6EVGYs.elf	Get hash	malicious	Gafgyt, Mirai	Browse	79.133.46.138
	https://sacasqr3r3wesdgdzx.blob.core.windows.net/cdaswqrs242asdsasa/mhdihjhjudiuas.html	Get hash	malicious	Phisher	Browse	79.133.41.53

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/var/cache/man/5680

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	622592
Entropy (8bit):	4.657827884365303
Encrypted:	false
SSDEEP:	6144:2v7lWAmFtL5N80nuvUpC076nKM/H9pPoARzzMRfPE6CwwNZ:ExWAmHBCGaDb+8w
MD5:	FB18C3CA88FA7799736523B80D7D75C2
SHA1:	AF7E8F1A8C17E6439087AE7FDF1E4B1E6A1B6CF5
SHA-256:	7D453A1D99527A10F0626890893537BBCB800E0B6314B6BBA3363DFD8141F6D8
SHA-512:	141B4A676B06CCA2D8421ACD3FD3B9C64E4C0875E04B3347AC62020B4AD8E9D3845039BBAF8F4069803A3E21BA2BC2EFAD296DCF68E7915559A2C5781F39C7E1
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	.W.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/cs/5680

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	1.6070136442091312
Encrypted:	false
SSDEEP:	48:bhVGQeUzGLIsWUMZJ5CggJHtheYdiKNHTlJ8NK:bhVGaGLIWMZXZgxeYtzll
MD5:	D0CA2EBA9E7A17D4680AA9DDC5F88946
SHA1:	270F443EFF85209052AE8FFA86660AFB0FAAD39B
SHA-256:	9504DC65F8B4E057D0939FA3B2C640FC703D0290EE19381836BAA5EB3EFBADBD
SHA-512:	9F999B0467E396E78A91F0BFE56E191DB9D9AFA6DC47858F3427CB44A39D5A13A206542A471CE15C8851674A234B9A7A49AAB7E6D5AF8D080BBC99C2BA3C56D8
Malicious:	false
Reputation:	high, very likely benign file
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/cs/index.db.I0HcxG

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.45676214072558463
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	EE429C7E8B222AFF73C611A8C358B661
SHA1:	DA353E80DCF1195F259CCBC32D39F5923710453F
SHA-256:	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
SHA-512:	DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
Malicious:	false
Reputation:	high, very likely benign file
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/da/5680

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	2.24195239843379
Encrypted:	false
SSDEEP:	96:bhHY2DzMnpU0QMiloesQdUTn3WVE0UnknJfsWdv0SBpEVvsb6eZeGfRL+:dYKM+oagn3WW5nkniWdv0SAVE6eZee6
MD5:	4DF08004EE4C5384C02376841F2B50BC
SHA1:	C02E58212CA012913390B4C1CCD64DD3353009EE
SHA-256:	F4D6A62A734E2844B99F3AD0EB480373AFBE56B29C0CFC9C70D9DFDF19D95C02
SHA-512:	6146001CA7028F58595235F244AE8FC4ECAEA3E95C83276514FC704E91B7596678E74CDE9963D680F2493F9C04AFDEBC4DB5094E2AB7C1A949E9378307AE0116
Malicious:	false
Reputation:	high, very likely benign file
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/da/index.db.UYMJTI

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.45676214072558463
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	EE429C7E8B222AFF73C611A8C358B661
SHA1:	DA353E80DCF1195F259CCBC32D39F5923710453F
SHA-256:	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
SHA-512:	DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
Malicious:	false
Reputation:	high, very likely benign file
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/de/5680

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	4.162654223582802
Encrypted:	false
SSDEEP:	768:hKTynsA3KVtOOcm2MrTJDEmf5RQOrHVDhtq5:QTyncXT+g3rB/q
MD5:	FE7DA97213B5158DE017D00035E2683A
SHA1:	0ECD1B17B4478ED728455D19A7E73261DEDAFE2E
SHA-256:	19EEE65152D764204D290E71F1939F63E44E99D5190E73A1AF337669EE98D8BA
SHA-512:	AFC9215A5E13580BBC5A794B6AF428B531B51B12C966200866E4FD57031A4F82198FFE73CD6D64289B95C1123E58D023CF4E2D6F2E6FC99F1A78430E662243AD
Malicious:	false
Preview:	.W.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/de/index.db.rgUFIG

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.20558603354177746
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	55880A8B73FD160B73198E09A21C83DB
SHA1:	5EB780702D2501747AF46F7525EF5C635EC5E64C
SHA-256:	66BD4C98AF40E2E208AC102ACD0F555A6C118E7258D91B833BE1D53EBFFB7BBB
SHA-512:	388924B8CAE80CCA6CA8E5109D0239A963A66CC0454450223EC7FB2A188F6F05E49632E535DC06E49DF6D007B221AA6B3D5F23C80203BCC861FF95EFA10AC1F9
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/es/5680

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.469989054365123
Encrypted:	false
SSDEEP:	96:bh8fr5fT5pYUBUtKGGTaZ1n3zbHGc2WjAXGBCgfd6Dgzs30z8ztvpWFoDXst4:qD5w6xT6n3zbNBSw/fd6Oz8ztQiDXo
MD5:	25F69E721343453F17D650B66F6725FD
SHA1:	E412A004F93F579547210D0D0113ABB70CAE29E1
SHA-256:	A2392B2B025C45E6C136BBC6AA16ADB8A5260A7BC1E4B21366F32EC255D5C0B5
SHA-512:	C8BF7E610B758A9C19F792B630A972213FF6525E82A477521D5702869856C3A504EA591BDE8F50CDF2C3C9BDC356631F326B3923333B186F855114A1A124FAEE
Malicious:	false
Preview:	.W..............................P......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/es/index.db.3uossF

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.3847690842836057
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	F0B902DEA5EF122A0B1F0F496DDC781B
SHA1:	90176D320A9C3601787D53CC346DC743367D53F1
SHA-256:	CFD64D42263C5D323AF423FC09CDB5DDB2F914114B87BAB6566EAB1020F15DE0
SHA-512:	3A5BC0E51D53A12E65441FB98E1201DC434C42DB389CFCA4C96FF65C2413CF9B06B29CC39A48BD3FDC61F4896396813E54B9C2CE404EF35AC33B35377E718874
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/fi/5680

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.5882948808594274
Encrypted:	false
SSDEEP:	12:Ey20yaajjjjjjjjjjjjjjjjjjjjjjjjjjGjjjjjjjjjjjjjjjjjjjjjjjjjjjjjp:bhjz+9Ab
MD5:	09F6ED1A60B8A4203EA97CF5926C6AFF
SHA1:	C28F4E393D55AD057E3C7608741904B796F67076
SHA-256:	56664D61D0BB8BF34CCA28C73CB314CB73EA1C4FAC64D2208B43F63C009FC855
SHA-512:	476EAE37D827C8BB322213799AB52DBE8FA43274DB3447BC5FEDFED64ECCEAF2C11DA375FDA09B37977D03CA1910E22443B22A3EEA875CE6F3BC698F8ADCC0E2
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/fi/index.db.cFlBLG

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.45676214072558463
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	EE429C7E8B222AFF73C611A8C358B661
SHA1:	DA353E80DCF1195F259CCBC32D39F5923710453F
SHA-256:	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
SHA-512:	DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/fr.ISO8859-1/5680

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.9312184489410064
Encrypted:	false
SSDEEP:	12:Ey20yIpyjjjjjjjjjjjjjjjjjjjjjjjjXjjjjjjjjjjjjjjjjjjjjjjjjjjjjGz7:bhbpFi043WmkN2GmGufUeDDx+yxrq3
MD5:	43ADE2E40B8B5A0DFA0A155FC9A02F7F
SHA1:	3D04BDFFD0E2A8433150C87D334014099336A5C5
SHA-256:	81E48EE4653A5E6F25C33133F24F045EB1EB2CC6724ECE0C5336612AB711273E
SHA-512:	C9C5C436A0E986A39CE3FA1CAF15A92D509F4450744BAE0283204B58CDD6FE9B8EEB8D3E2CAFB4B1ACB46729317FFAEFE86B0DD2D60472CAB30B204CC2003B03
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/fr.ISO8859-1/index.db.HdgbZF

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.45676214072558463
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	EE429C7E8B222AFF73C611A8C358B661
SHA1:	DA353E80DCF1195F259CCBC32D39F5923710453F
SHA-256:	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
SHA-512:	DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/fr.UTF-8/5680

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.9312184489410064
Encrypted:	false
SSDEEP:	12:Ey20yIpyjjjjjjjjjjjjjjjjjjjjjjjjXjjjjjjjjjjjjjjjjjjjjjjjjjjjjGz7:bhbpFi043WmkN2GmGufUeDDx+yxrq3
MD5:	43ADE2E40B8B5A0DFA0A155FC9A02F7F
SHA1:	3D04BDFFD0E2A8433150C87D334014099336A5C5
SHA-256:	81E48EE4653A5E6F25C33133F24F045EB1EB2CC6724ECE0C5336612AB711273E
SHA-512:	C9C5C436A0E986A39CE3FA1CAF15A92D509F4450744BAE0283204B58CDD6FE9B8EEB8D3E2CAFB4B1ACB46729317FFAEFE86B0DD2D60472CAB30B204CC2003B03
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/fr.UTF-8/index.db.GnVfhI

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.45676214072558463
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	EE429C7E8B222AFF73C611A8C358B661
SHA1:	DA353E80DCF1195F259CCBC32D39F5923710453F
SHA-256:	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
SHA-512:	DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/fr/5680

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	3.843408177285207
Encrypted:	false
SSDEEP:	768:A4VX6Bd+dla5HmdT8qHl87BaIPay4uz8HksUHnxNO:A4ROd+dStM83PavUHf
MD5:	8DE0199D9AAD6EF37915217DDE3E1818
SHA1:	3E5D323135A4B030407FAFAFA4BB3752FF21A386
SHA-256:	6E4E4A64134577FBCAF8DC36BCB56CBEC70980282DC85E7C0AB1E4AB2AF4C2CB
SHA-512:	6A308F160181999863DC9DEC4D4F073844958E797968E78B3C8613AD39B326967EACB0AF01C6FE0FBE614DC2C91B1A831AF848F140C3B749D7D91B76B36CE22D
Malicious:	false
Preview:	.W.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/fr/index.db.rDT1KH

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.22208993462959856
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	425CB57CD9B42556C8089FE7A7A3E495
SHA1:	4F33F9A9897218FDED958FD8F8D7AF7CD8BC48F3
SHA-256:	85E01EFF2AC0C83C827E118D5CE2CD1E1A19E059688B6E0D09CB3CC131F065D3
SHA-512:	8C7D4DACF5C5C5C4B78775048427AF99ED8057590AA3A69FD5B3F875B6DDD249A6DB0AF3A51BB96A7F629D1017B272317583A8DFF89FB3968FFE2F246F040F33
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/hu/5680

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.9419610786280751
Encrypted:	false
SSDEEP:	24:bh04IR9rYz9kvNQFl46MdnqfPE9eTuF0Ce:bhXIHakVQmnqXqeT/Ce
MD5:	18F02B57872A97DE1E82FF5348A5AF1B
SHA1:	52F332343B120B1C950AC02B3C923556C70DC62A
SHA-256:	5C605DE68B3E05754698485F73413F4052AEA8C3AAE6012AC6416B3B6B056DF7
SHA-512:	E33A8412F52D26BDE55E4D72E0D9D09EB777F4B882F5BB1C4625AB392EE321D6ACD8795001BF50CCDACFAC131A1263B1398F208799F753554C43349136EB8BEC
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/hu/index.db.DYAY7I

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.45676214072558463
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	EE429C7E8B222AFF73C611A8C358B661
SHA1:	DA353E80DCF1195F259CCBC32D39F5923710453F
SHA-256:	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
SHA-512:	DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/id/5680

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	1.309811236154278
Encrypted:	false
SSDEEP:	48:bhESUeDVrWTVd5ekRv/KSmGWqR0VouC4btU8IzTC74ExJKGtII:bhEVeBqTVdAcn3Iowl4UBtx
MD5:	3AFDA1B0F729816929FF7A6628D776D5
SHA1:	5982940A5782F11AEB5BF859C055DE3FEFBDF5DB
SHA-256:	77809D5F38F6D96A2E8BA9BE0DFBB16C10B6B1FF7D2BA1DD5FB9437F73C47E7F
SHA-512:	6D4CE03475C68EDC0AE928E7F65BB8C06198721146A1266F55455AF3D5E24F44A569E007C0DC44BC7745C1573DBC7F02B8C4094F9BD97FAF6A0B5894BE0E07E5
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/id/index.db.iMY09G

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.45676214072558463
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	EE429C7E8B222AFF73C611A8C358B661
SHA1:	DA353E80DCF1195F259CCBC32D39F5923710453F
SHA-256:	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
SHA-512:	DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/index.db.0wy8BG

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	622592
Entropy (8bit):	0.022159377425242585
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	2E442DBA85DEDFDCB07090FDF9DE90D0
SHA1:	02658086E93854D13D82B1F0D80F4B78D26DCA51
SHA-256:	62406BFE7657964E490DE65A0007F7C1D59B62B2B9AD35BA55BA219673378848
SHA-512:	FDBBA0DEF310CF7DBF448CFB6E5C9CDCEFBF6A0CAEB26CA3AFA91A388FBA10A9E77BCC27CA9B0AEA2A7B67F964849E147FB44862C7394C2C7CDCB572C06FCB05
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/it/5680

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	3.3621193886235408
Encrypted:	false
SSDEEP:	384:Jtp0q5d98n3SaMfhtxfmbMy+HseeNwoMbHf:JDd9QSBf
MD5:	B228DE097081AF360D337CF8C8FF2C6F
SHA1:	7DD2C4640925B225F98014566F73C35F4E960940
SHA-256:	1056CECADA78542B173EE469C9BEAF61F81298EBBD21B54EA6EE449028E18B3F
SHA-512:	F61D7F9040E452C4B1B77F3657BE4252475C3BF23D78EED903A5E55FA97BA0571BA3AD90DBA7F77C334DF5B721F909B12720515034421A4AAB0450D1D43B32E4
Malicious:	false
Preview:	.W..............................P......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/it/index.db.PwsfAI

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.3847690842836057
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	F0B902DEA5EF122A0B1F0F496DDC781B
SHA1:	90176D320A9C3601787D53CC346DC743367D53F1
SHA-256:	CFD64D42263C5D323AF423FC09CDB5DDB2F914114B87BAB6566EAB1020F15DE0
SHA-512:	3A5BC0E51D53A12E65441FB98E1201DC434C42DB389CFCA4C96FF65C2413CF9B06B29CC39A48BD3FDC61F4896396813E54B9C2CE404EF35AC33B35377E718874
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/ja/5680

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	3.667488020062395
Encrypted:	false
SSDEEP:	192:CF4pPRfAgFn35FF1veUMjGiEGBuPhiB0PUKwA+U:5PRfAgFn35MSeAPUjN
MD5:	D3CD7D67F8155491493BB7235FB9AA57
SHA1:	5A7AE62A7AFE50EFCCED06CBD56AE2A0A284EFF3
SHA-256:	6958349ECA637F99AABC419B5E402CFB50BC5B8867F31BCB67F064F47A209929
SHA-512:	1168BF697CDE563F7D82A71EAE1CD496EA81D178B26F87EAAF2EDEED13274B1E3500CE1C981647717598495EBE1FF8F8AC54AD33547506E566C925D7002F5CFF
Malicious:	false
Preview:	.W..............................P......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/ja/index.db.qnlTsG

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.3847690842836057
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	F0B902DEA5EF122A0B1F0F496DDC781B
SHA1:	90176D320A9C3601787D53CC346DC743367D53F1
SHA-256:	CFD64D42263C5D323AF423FC09CDB5DDB2F914114B87BAB6566EAB1020F15DE0
SHA-512:	3A5BC0E51D53A12E65441FB98E1201DC434C42DB389CFCA4C96FF65C2413CF9B06B29CC39A48BD3FDC61F4896396813E54B9C2CE404EF35AC33B35377E718874
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/ko/5680

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.7847786157292606
Encrypted:	false
SSDEEP:	12:Ey20yYn0jjjjjjjjjjjjjjjjjjjjjjjjjjGjjjjjjjjjjjjjjjjjjjjjjjjjmjj7:bhXYznMk31RFe6f
MD5:	FBA25855E1C99D8F87E8AC13E2E2ECB1
SHA1:	D99351AC40D6CC4C9BE54E0E018C44A9A88983D7
SHA-256:	C0E18ED1CEFF427FD4D57D1B79CE1AF7320AC8453BAF8A0349C08267464C4D71
SHA-512:	0969DF6506E083A4995A18518BC3C4472157E7790EEC26C08221B0FC6DE9C7DA0ADB11CF92C56BC35B89BC60447F3D991F935E352552B58FB9BD1D4B2579FBB0
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/ko/index.db.4yz2iI

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.45676214072558463
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	EE429C7E8B222AFF73C611A8C358B661
SHA1:	DA353E80DCF1195F259CCBC32D39F5923710453F
SHA-256:	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
SHA-512:	DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/nl/5680

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	2.554204221242331
Encrypted:	false
SSDEEP:	192:H8Y5a2oquB2aCYn3lvu3whjXVobdbs7dq1KJGbtf0Hoa:hoquYaCYn3Q8jXqbdbs7dGbKHoa
MD5:	27FED1CA8EB0101C459D9A617C833293
SHA1:	503B2A3E33FE79FF2CD58F831ED33DB358849BEA
SHA-256:	C3033C4F7CF0D6108611EF5A62CA893F98EE6463DDCFF7100D3BAFDEB0036D9E
SHA-512:	7BD630F5E0C5A91C34D2E48D0053923C9F2F5BAA07D21FDA79E60F3AFDF759E594E6639562C1F3EE68DD080D417009DC3AFB7DA534E3B8C29FF7B10438C3FD4E
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/nl/index.db.w2nWXG

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.45676214072558463
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	EE429C7E8B222AFF73C611A8C358B661
SHA1:	DA353E80DCF1195F259CCBC32D39F5923710453F
SHA-256:	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
SHA-512:	DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/pl/5680

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.880948418505059
Encrypted:	false
SSDEEP:	192:7Sf8026LXqn3ZTV6pXAmA44BRqvc3X3GVAjvAk/AvdWjWftxA:E802uXqn3/6pxARqr8kdWjW1
MD5:	37CEBCD3F5BF6322785FFF568EE33131
SHA1:	201298C827C77C60CD314BF721DC4C27EF95BD64
SHA-256:	012C5597C5DD8654EB14432AFCEFD9B131F2CE75AD21488991A5A688929AAEA6
SHA-512:	CCC8A8CCF4ACA332CAF610155DE9E7C4A12D1C45C98D20766B86098A3D2EF332189F159E3956944CD302DF652FE7A6F0D07CA39CBE7DF4A655D3211452487582
Malicious:	false
Preview:	.W..............................P......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/pl/index.db.AxiNcG

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.3847690842836057
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	F0B902DEA5EF122A0B1F0F496DDC781B
SHA1:	90176D320A9C3601787D53CC346DC743367D53F1
SHA-256:	CFD64D42263C5D323AF423FC09CDB5DDB2F914114B87BAB6566EAB1020F15DE0
SHA-512:	3A5BC0E51D53A12E65441FB98E1201DC434C42DB389CFCA4C96FF65C2413CF9B06B29CC39A48BD3FDC61F4896396813E54B9C2CE404EF35AC33B35377E718874
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/pt/5680

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.413200731126695
Encrypted:	false
SSDEEP:	192:KqFPMGn35+0+eo8TAnBW4VppKP8qtRuI:xPHn35+peo8T8V/fq6I
MD5:	10C8D94B4EB46E7CF59FDBBDB64C3E44
SHA1:	09A0C09834B1D84F5E24E7602182A5B90BB0F9B6
SHA-256:	F08266CEE0E60565B4F81D2D3D276B47FAF27A774278694F2E83F440016689CD
SHA-512:	7E8673703CB8BC9DEBEC1ACC297898BC0690704FC5613FAECF4AA2946E46556703952E11CC90DC2A8133A84628FD5674349B6911111A69AFE65618CE8F7FA5C8
Malicious:	false
Preview:	.W..............................P......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/pt/index.db.Ltq9TH

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.3847690842836057
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	F0B902DEA5EF122A0B1F0F496DDC781B
SHA1:	90176D320A9C3601787D53CC346DC743367D53F1
SHA-256:	CFD64D42263C5D323AF423FC09CDB5DDB2F914114B87BAB6566EAB1020F15DE0
SHA-512:	3A5BC0E51D53A12E65441FB98E1201DC434C42DB389CFCA4C96FF65C2413CF9B06B29CC39A48BD3FDC61F4896396813E54B9C2CE404EF35AC33B35377E718874
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/pt_BR/5680

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	1.7510008687365202
Encrypted:	false
SSDEEP:	48:bhX6G+IwvnUZe4Gv/KSmGROqAQAuSe0dDOfInYbmucrm3QEAvJBFIz:bhq5bnUY4Gn3P+/Z1tvJDQ
MD5:	A11F5E85A2A07AF84255570AE29318FB
SHA1:	D06BF25E5FD4A17BCF7C5BD77ACD747F0FE181E8
SHA-256:	8FFA8BC408B254217275A622D054853CB72B08409A11AA49C4C664C0DABFB62F
SHA-512:	059F3CBC93750B68942D88EDD4AD2531B2291CEC421EB903280B9105010D1C8AD70F9F3CFA1B1A50D5110DCBFDB807A6E7A3F9EBC9A48AC8C3A49DEC4B6B3899
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/pt_BR/index.db.QQZURG

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.45676214072558463
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	EE429C7E8B222AFF73C611A8C358B661
SHA1:	DA353E80DCF1195F259CCBC32D39F5923710453F
SHA-256:	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
SHA-512:	DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/ru/5680

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	3.440634655325007
Encrypted:	false
SSDEEP:	384:SpjHrhEon3PRekEF3PS6y13Vi6w5TlmmcOB:Q3hNEk23MuxrB
MD5:	DF5C1114538C5D8EA1EE929FFAC24E3C
SHA1:	B6331AF77566B63EA8204BE85F5DC99FAF51479E
SHA-256:	F238C75DAD82E10AB011A9BF79775B2A5F5889644A5A06835933340845A08555
SHA-512:	9514A424CC2A9290F749F527F515B35E45C6A829CB3930DBFB39DC9D70A684640A31686EC77258FF285FE89B6DD44BB01A478848FF9B3EBD764741A6F7856704
Malicious:	false
Preview:	.W..............................`......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/ru/index.db.XAOhwJ

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	0.3337394253577246
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	5B66CE03BFE548DEE335E0518E4E0554
SHA1:	65397845DC679AA972454B0FF237A513C0F490CB
SHA-256:	C38BB21B1D92166794DC09807C9A55B67B0A760C684FEEDD0C931F8415DD6D29
SHA-512:	A31C3D23F25607333250443490F0EE295BB702B46A636905FD413E8AEAA8ED23AAB42106868D2938718555C9DEEFB69FB416CAF5228A422F64D6CA8DB438FEE8
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/sl/5680

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.8558400366712392
Encrypted:	false
SSDEEP:	12:Ey20y8jjjjjjjjjjjjjjjjjjjjjjjjjjGjjjKuV0jjjjjjjjjjjjjjjjjjjjjjje:bhaVZjx6ot7m13SmZQs
MD5:	67697BEA7C23E4805A82FE9755BB3CAE
SHA1:	14ACAFF0BECBDB116E4C0BC329E59DEF68CF46D1
SHA-256:	553DA7FF76999B7CCC4450498B11E6BD98B3B1E5FF81D82A53568F84B0D270D5
SHA-512:	D966DD6430003E708C6EE10764DC072A1ED0A252E6E1C822CBD28271A2EDD4B1F61C7F9AA7D1D442D6175791A104A365DE25B9C2598500AE705C9250C8BA46A1
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/sl/index.db.Yhc6oF

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.45676214072558463
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	EE429C7E8B222AFF73C611A8C358B661
SHA1:	DA353E80DCF1195F259CCBC32D39F5923710453F
SHA-256:	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
SHA-512:	DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/sr/5680

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	1.3868484511023333
Encrypted:	false
SSDEEP:	48:bhLSUCt/WFekRv/KSmGWqApnEVyfNsu+tBNGg2PgULLE2vRy2QwfoQEDiR2e3iRj:bhLVC48cn3Vu2FtBv7AtboQIqb3qwK
MD5:	0DD75ECC81E4E564EA56A57FF32A24D3
SHA1:	859C0FE5F86A2C5A32BAD7920787BE845F34C4FB
SHA-256:	DB778B175D19DEFA4180D0B12D675AD0B8B22CC4BB77702D9EC8510F894EB3B1
SHA-512:	7B0C56A76797383527509F8036EB4911F8925E7ACC005CDC3269F0A43231479E3A0A9887BF4D2979F05CBFE18324997DEF715FDA6921EEF827B385C9D902C708
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/sr/index.db.ZgDkHI

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.45676214072558463
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	EE429C7E8B222AFF73C611A8C358B661
SHA1:	DA353E80DCF1195F259CCBC32D39F5923710453F
SHA-256:	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
SHA-512:	DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/sv/5680

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	2.5432558448090097
Encrypted:	false
SSDEEP:	96:bhk/+fz7b9ldxbe2Vn3iwkVJIB0D6c6aZ4+1Wrzbxpl4/tMe1:imrn9lHbe2Vn3iwKhD6cvTAbl4/tMe
MD5:	D97454D6B1F39F39966A809BCA3D9647
SHA1:	276931CED8F34B7651C1BDFC8522FF0560E2C377
SHA-256:	DCB8CE7F4F21595D851100F315C56B717541DB898AEB9ED9C0CCC9FF217A5801
SHA-512:	3E014F3EA8EEE79B87726EDA6291AC2D0BD9B22803EE848F61CA2AAD39D5FB87704410C57C648EE4AF8A1B78EFB0D766524F6DB750208C9BAC346079FD8EE69E
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/sv/index.db.LUAr5H

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.45676214072558463
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	EE429C7E8B222AFF73C611A8C358B661
SHA1:	DA353E80DCF1195F259CCBC32D39F5923710453F
SHA-256:	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
SHA-512:	DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/tr/5680

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	1.7558188637474321
Encrypted:	false
SSDEEP:	96:bhWV1OIM7cn3UZiPU1wywyoEpJmz6W2Mzgg:YDOL4n3fPvywrzgMU
MD5:	5F905B930E7310E72BC3DF5C50F8E579
SHA1:	50B1AD3115F095C743CB26F87ECCE406FAC3523B
SHA-256:	1DB72BA77CA01F25CA9768999825D8F97F5ED4D00E17C9130D6F7CDE34130270
SHA-512:	A6066F4DF4097DB93673CD156BBE5F910C3F64D01E1671E481BC9FBDD720DBD6F8CEF337E20404F7C6AE97B2FA1F5E67088041ACBB6EA85D6758924D5740D06C
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/tr/index.db.XDayGH

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.45676214072558463
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	EE429C7E8B222AFF73C611A8C358B661
SHA1:	DA353E80DCF1195F259CCBC32D39F5923710453F
SHA-256:	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
SHA-512:	DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/zh_CN/5680

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	2.6210042560348144
Encrypted:	false
SSDEEP:	48:bh5roGafX8XKu5YIoBHtF2YekDsv/KSmGWNmA/y0uJNI/oyjaOUUfEHKn9nnjoEJ:bhdoLfX8N9oBNF2XFn3UD/9FZiy0aoN
MD5:	39398A15564A55EB7BFE895D7668A5A3
SHA1:	28DA677435B87176E08AFABBF8B51F7B93E22948
SHA-256:	A4C0216476E357ED3A23E71333DBE7DE91E04370EF049032EE8E47BB1EDBD83B
SHA-512:	B4E69212338C742F8C83194552078A86E4BED59375D82563C0B4059B7E0D6A58D6317151AB1F2A6FB20D2FF6DB7C550DF6A6984B2BB873A111D58AF9AEB7D95E
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/zh_CN/index.db.dkiVoJ

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.45676214072558463
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	EE429C7E8B222AFF73C611A8C358B661
SHA1:	DA353E80DCF1195F259CCBC32D39F5923710453F
SHA-256:	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
SHA-512:	DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/zh_TW/5680

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	1.0170167917961734
Encrypted:	false
SSDEEP:	24:bhAvIZuF4ptmpzf50dhOv8WvxjMMhFmMKxevOfOots+:bhDi4p+ahOhFFKxewj
MD5:	1FC5F2B98E5BC25B10373353D91B86B1
SHA1:	D848DA35B0731328195D59C1E996B95C4952F1F9
SHA-256:	509FAD18B4454CD70D974755F6156D4A5FA9B960AB9FF468D1FC350F0B64F379
SHA-512:	95BC2E289EDE5D9A3F56C9D8AE9DD13D9379BE2ABF8927CDABBE92B9F57A8EB667E9C08E4DFD82BF9F1F57118CE6E495722ADA2668AFF4FA0540F46C0A6D5138
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/zh_TW/index.db.DzJaNF

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.45676214072558463
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	EE429C7E8B222AFF73C611A8C358B661
SHA1:	DA353E80DCF1195F259CCBC32D39F5923710453F
SHA-256:	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
SHA-512:	DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/lib/logrotate/status.tmp

Download File

Process:	/usr/sbin/logrotate
File Type:	ASCII text
Category:	dropped
Size (bytes):	1615
Entropy (8bit):	4.780689896107124
Encrypted:	false
SSDEEP:	48:UUjuqJM+h0inK4+Dq4I+ho+cs2+UW+d+A5e5xUU+q4T+DNY+U1S+3o9NqqJNl+q4:Ry9OJ4Ih9hWuriP4T46ho15nlP4hlho2
MD5:	CCDD017AB675CE34E1B2AD304AA7F28F
SHA1:	AA3B586E43C4D5078B0EB5F3F3FB5CC3D504541D
SHA-256:	F4A2CAC0A1A16E17A7BC82BDBD626568F0F77CE10A9BBF9B95559C5C70416B69
SHA-512:	A47392D75266219680506F906440503122AD7D1DF7343F866CFECC423FC649AFC073D62D5600EDAD2E93664FE4C493648AA40A1E0A2DE51C03C0F4DF2322C053
Malicious:	false
Preview:	logrotate state -- version 2."/var/log/syslog" 2024-10-24-4:57:37."/var/log/dpkg.log" 2023-7-31-11:2:47."/var/log/unattended-upgrades/unattended-upgrades.log" 2024-10-24-4:57:37."/var/log/speech-dispatcher/debug-flite" 2024-10-24-4:0:0."/var/log/unattended-upgrades/unattended-upgrades-shutdown.log" 2024-10-24-4:57:37."/var/log/auth.log" 2024-10-24-4:57:37."/var/log/apt/term.log" 2023-7-31-11:2:47."/var/log/ppp-connect-errors" 2024-10-24-4:0:0."/var/log/apport.log" 2024-10-24-4:57:37."/var/log/speech-dispatcher/speech-dispatcher-protocol.log" 2024-10-24-4:0:0."/var/log/apt/history.log" 2023-7-31-11:2:47."/var/log/boot.log" 2024-10-24-4:0:0."/var/log/alternatives.log" 2021-9-17-9:23:29."/var/log/lightdm/*.log" 2024-10-24-4:0:0."/var/log/mail.log" 2024-10-24-4:0:0."/var/log/debug" 2024-10-24-4:0:0."/var/log/kern.log" 2024-10-24-4:57:37."/var/log/cups/access_log" 2024-10-24-4:57:37."/var/log/ufw.log" 2024-10-24-4:0:0."/var/log/speech-dispatcher/speech-dispatcher.log" 2024-10-24-4:0:0."/var

Static File Info

General

File type:	ELF 32-bit MSB executable, SPARC, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.066384092921695
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	3kMnPQIVHR.elf
File size:	58'376 bytes
MD5:	3b72798211c3a5312ddc188a8b9fc23a
SHA1:	8212d1b8ffe7e227e447c0590085f207779fde77
SHA256:	44d76874446f3e2bc99b96b99148f33872639bc15eb33f3ff1f64d5c1fd636cb
SHA512:	21e75406e33bf1729bb5819c1dcbbb44de2a8118dac3dd53f07350acca169c65fe72a50cb9afe54a6f5b51402c2add3a4905684b01e95b95b344abf2c60b86d7
SSDEEP:	768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAwa:RqtmZPuutfbltZFBSJsBcfDSTFI+BEa
TLSH:	19432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8
File Content Preview:	.ELF...........................4...x.....4. ...(.......................................................8...P........dt.Q................................@..(....@.2.................#.....b8..`.....!..... ...@.....".........`......$ ... ...@...........`....

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	Sparc
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x101a4
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	57976
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x10094	0x94	0x1c	0x0	0x6	AX	4
.text	PROGBITS	0x100b0	0xb0	0xc888	0x0	0x6	AX	4
.fini	PROGBITS	0x1c938	0xc938	0x14	0x0	0x6	AX	4
.rodata	PROGBITS	0x1c950	0xc950	0x11b0	0x0	0x2	A	8
.ctors	PROGBITS	0x2e000	0xe000	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x2e008	0xe008	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x2e018	0xe018	0x220	0x0	0x3	WA	8
.bss	NOBITS	0x2e238	0xe238	0x318	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0xe238	0x3e	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x10000	0x10000	0xdb00	0xdb00	6.1729	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0xe000	0x2e000	0x2e000	0x238	0x550	2.9229	0x6	RW	0x10000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 24, 2024 06:58:43.415760994 CEST	45972	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:43.421291113 CEST	3778	45972	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:43.421350956 CEST	45972	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:43.450643063 CEST	45972	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:43.456011057 CEST	3778	45972	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:43.456047058 CEST	45972	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:43.461402893 CEST	3778	45972	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:44.251471043 CEST	3778	45972	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:44.251543999 CEST	45972	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:44.251673937 CEST	45972	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:44.252666950 CEST	45974	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:44.258265972 CEST	3778	45974	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:44.258331060 CEST	45974	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:44.262765884 CEST	45974	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:44.268673897 CEST	3778	45974	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:44.268729925 CEST	45974	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:44.274157047 CEST	3778	45974	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:45.092431068 CEST	3778	45974	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:45.092487097 CEST	45974	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:45.092540026 CEST	45974	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:45.094650030 CEST	45976	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:45.100105047 CEST	3778	45976	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:45.100162029 CEST	45976	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:45.105401993 CEST	45976	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:45.110846043 CEST	3778	45976	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:45.110886097 CEST	45976	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:45.116235018 CEST	3778	45976	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:45.940824986 CEST	3778	45976	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:45.940905094 CEST	45976	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:45.940992117 CEST	45976	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:45.941781998 CEST	45978	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:45.947129965 CEST	3778	45978	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:45.947197914 CEST	45978	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:45.949362040 CEST	45978	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:45.954663992 CEST	3778	45978	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:45.954711914 CEST	45978	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:45.960077047 CEST	3778	45978	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:46.786957026 CEST	3778	45978	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:46.787163019 CEST	45978	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:46.787163019 CEST	45978	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:46.788248062 CEST	45980	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:46.793762922 CEST	3778	45980	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:46.793839931 CEST	45980	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:46.795854092 CEST	45980	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:46.801259995 CEST	3778	45980	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:46.801311970 CEST	45980	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:46.810215950 CEST	3778	45980	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:47.633923054 CEST	3778	45980	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:47.634015083 CEST	45980	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:47.634015083 CEST	45980	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:47.670516014 CEST	45982	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:47.675972939 CEST	3778	45982	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:47.676237106 CEST	45982	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:47.700525999 CEST	45982	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:47.705900908 CEST	3778	45982	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:47.705998898 CEST	45982	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:47.711380959 CEST	3778	45982	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:48.511404991 CEST	3778	45982	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:48.511487961 CEST	45982	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:48.511487961 CEST	45982	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:48.512242079 CEST	45984	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:48.517577887 CEST	3778	45984	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:48.517626047 CEST	45984	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:48.519467115 CEST	45984	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:48.524755955 CEST	3778	45984	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:48.524794102 CEST	45984	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:48.530111074 CEST	3778	45984	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:49.342287064 CEST	3778	45984	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:49.342560053 CEST	45984	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:49.342603922 CEST	45984	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:49.343375921 CEST	45986	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:49.348906994 CEST	3778	45986	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:49.348995924 CEST	45986	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:49.350526094 CEST	45986	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:49.355791092 CEST	3778	45986	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:49.356082916 CEST	45986	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:49.361423969 CEST	3778	45986	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:50.183146954 CEST	3778	45986	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:50.186403990 CEST	45986	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:50.186403990 CEST	45986	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:50.202548027 CEST	45988	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:50.207952976 CEST	3778	45988	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:50.210458994 CEST	45988	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:50.294315100 CEST	45988	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:50.299582958 CEST	3778	45988	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:50.307102919 CEST	45988	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:50.313524961 CEST	3778	45988	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:51.055089951 CEST	3778	45988	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:51.055262089 CEST	45988	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:51.055357933 CEST	45988	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:51.055929899 CEST	45990	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:51.061197042 CEST	3778	45990	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:51.061244011 CEST	45990	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:51.062102079 CEST	45990	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:51.067555904 CEST	3778	45990	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:51.067591906 CEST	45990	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:51.073136091 CEST	3778	45990	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:51.899519920 CEST	3778	45990	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:51.899595022 CEST	45990	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:51.899624109 CEST	45990	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:51.900335073 CEST	45992	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:51.905767918 CEST	3778	45992	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:51.905818939 CEST	45992	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:51.906439066 CEST	45992	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:51.911802053 CEST	3778	45992	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:51.911865950 CEST	45992	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:51.917432070 CEST	3778	45992	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:52.743988991 CEST	3778	45992	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:52.744072914 CEST	3778	45992	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:52.744126081 CEST	45992	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:52.744126081 CEST	45992	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:52.744203091 CEST	45992	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:52.744662046 CEST	45994	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:52.750355959 CEST	3778	45994	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:52.750416040 CEST	45994	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:52.751085043 CEST	45994	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:52.756658077 CEST	3778	45994	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:52.756844997 CEST	45994	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:52.762243032 CEST	3778	45994	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:53.579427004 CEST	3778	45994	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:53.579690933 CEST	45994	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:53.579690933 CEST	45994	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:53.580229044 CEST	45996	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:53.585813046 CEST	3778	45996	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:53.585866928 CEST	45996	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:53.586992979 CEST	45996	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:53.592411995 CEST	3778	45996	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:53.592457056 CEST	45996	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:53.597906113 CEST	3778	45996	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:54.406668901 CEST	3778	45996	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:54.406821966 CEST	45996	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:54.406857014 CEST	45996	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:54.407345057 CEST	45998	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:54.412688971 CEST	3778	45998	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:54.412745953 CEST	45998	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:54.413518906 CEST	45998	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:54.418831110 CEST	3778	45998	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:54.418876886 CEST	45998	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:54.424272060 CEST	3778	45998	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:55.242343903 CEST	3778	45998	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:55.242487907 CEST	45998	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:55.242489100 CEST	45998	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:55.243293047 CEST	46000	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:55.248992920 CEST	3778	46000	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:55.249047995 CEST	46000	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:55.249969006 CEST	46000	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:55.255238056 CEST	3778	46000	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:55.255336046 CEST	46000	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:55.260632992 CEST	3778	46000	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:56.174122095 CEST	3778	46000	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:56.174357891 CEST	46000	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:56.174357891 CEST	46000	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:56.174829960 CEST	46002	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:56.180957079 CEST	3778	46002	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:56.181005001 CEST	46002	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:56.181647062 CEST	46002	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:56.187050104 CEST	3778	46002	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:56.187144041 CEST	46002	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:56.192512035 CEST	3778	46002	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:57.012970924 CEST	3778	46002	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:57.012996912 CEST	3778	46002	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:57.013147116 CEST	46002	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:57.013147116 CEST	46002	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:57.013147116 CEST	46002	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:57.013623953 CEST	46004	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:57.019016981 CEST	3778	46004	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:57.019074917 CEST	46004	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:57.019764900 CEST	46004	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:57.025053978 CEST	3778	46004	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:57.025099039 CEST	46004	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:57.030724049 CEST	3778	46004	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:57.859961987 CEST	3778	46004	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:57.859982014 CEST	3778	46004	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:57.860280037 CEST	46004	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:57.860280037 CEST	46004	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:57.860280037 CEST	46004	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:57.860569000 CEST	46006	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:57.865906000 CEST	3778	46006	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:57.865972996 CEST	46006	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:57.866591930 CEST	46006	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:57.871944904 CEST	3778	46006	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:57.872008085 CEST	46006	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:57.877316952 CEST	3778	46006	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:58.693098068 CEST	3778	46006	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:58.693455935 CEST	46006	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:58.693456888 CEST	46006	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:58.693845987 CEST	46008	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:58.699417114 CEST	3778	46008	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:58.699579954 CEST	46008	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:58.700577021 CEST	46008	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:58.706037998 CEST	3778	46008	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:58.706183910 CEST	46008	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:58.711611986 CEST	3778	46008	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:59.540915012 CEST	3778	46008	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:59.540940046 CEST	3778	46008	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:59.541070938 CEST	46008	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:59.541070938 CEST	46008	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:59.541121006 CEST	46008	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:59.541579962 CEST	46010	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:59.547308922 CEST	3778	46010	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:59.547528028 CEST	46010	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:59.548523903 CEST	46010	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:59.554239988 CEST	3778	46010	79.133.46.243	192.168.2.14
Oct 24, 2024 06:58:59.554349899 CEST	46010	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:58:59.560056925 CEST	3778	46010	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:00.790960073 CEST	3778	46010	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:00.791193962 CEST	46010	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:00.791193962 CEST	46010	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:00.791359901 CEST	3778	46010	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:00.791418076 CEST	46010	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:00.791678905 CEST	46012	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:00.796900988 CEST	3778	46012	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:00.796950102 CEST	46012	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:00.797637939 CEST	46012	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:00.803088903 CEST	3778	46012	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:00.803215981 CEST	46012	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:00.808526993 CEST	3778	46012	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:01.637015104 CEST	3778	46012	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:01.637238979 CEST	46012	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:01.637238979 CEST	46012	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:01.637609005 CEST	46014	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:01.643371105 CEST	3778	46014	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:01.643425941 CEST	46014	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:01.644041061 CEST	46014	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:01.650304079 CEST	3778	46014	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:01.650350094 CEST	46014	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:01.655658960 CEST	3778	46014	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:02.466495037 CEST	3778	46014	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:02.466522932 CEST	3778	46014	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:02.466576099 CEST	46014	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:02.466576099 CEST	46014	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:02.466604948 CEST	46014	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:02.467149019 CEST	46016	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:02.472547054 CEST	3778	46016	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:02.472600937 CEST	46016	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:02.473547935 CEST	46016	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:02.479646921 CEST	3778	46016	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:02.479686975 CEST	46016	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:02.486319065 CEST	3778	46016	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:03.307621002 CEST	3778	46016	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:03.307894945 CEST	46016	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:03.307895899 CEST	46016	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:03.308716059 CEST	46018	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:03.314064980 CEST	3778	46018	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:03.314119101 CEST	46018	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:03.315160036 CEST	46018	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:03.320426941 CEST	3778	46018	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:03.320472956 CEST	46018	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:03.325853109 CEST	3778	46018	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:04.148557901 CEST	3778	46018	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:04.148767948 CEST	46018	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:04.148767948 CEST	46018	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:04.149769068 CEST	46020	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:04.155200958 CEST	3778	46020	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:04.155286074 CEST	46020	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:04.156450033 CEST	46020	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:04.161799908 CEST	3778	46020	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:04.161853075 CEST	46020	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:04.167151928 CEST	3778	46020	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:04.989116907 CEST	3778	46020	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:04.989429951 CEST	46020	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:04.989429951 CEST	46020	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:04.990271091 CEST	46022	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:04.995601892 CEST	3778	46022	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:04.995657921 CEST	46022	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:04.997015953 CEST	46022	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:05.002306938 CEST	3778	46022	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:05.002357960 CEST	46022	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:05.007736921 CEST	3778	46022	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:05.840779066 CEST	3778	46022	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:05.841006041 CEST	46022	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:05.841006041 CEST	46022	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:05.841641903 CEST	46024	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:05.847068071 CEST	3778	46024	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:05.847155094 CEST	46024	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:05.848458052 CEST	46024	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:05.853708029 CEST	3778	46024	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:05.853760004 CEST	46024	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:05.859122038 CEST	3778	46024	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:06.677460909 CEST	3778	46024	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:06.677634954 CEST	46024	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:06.677634954 CEST	46024	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:06.677700996 CEST	3778	46024	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:06.677773952 CEST	46024	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:06.678355932 CEST	46026	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:06.683722019 CEST	3778	46026	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:06.683789015 CEST	46026	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:06.684884071 CEST	46026	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:06.690481901 CEST	3778	46026	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:06.690522909 CEST	46026	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:06.697262049 CEST	3778	46026	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:07.504458904 CEST	3778	46026	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:07.504662991 CEST	46026	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:07.504663944 CEST	46026	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:07.505742073 CEST	46028	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:07.511136055 CEST	3778	46028	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:07.511199951 CEST	46028	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:07.512352943 CEST	46028	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:07.517690897 CEST	3778	46028	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:07.517745018 CEST	46028	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:07.523056030 CEST	3778	46028	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:08.352178097 CEST	3778	46028	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:08.352303028 CEST	46028	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:08.352391005 CEST	46028	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:08.353195906 CEST	46030	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:08.358560085 CEST	3778	46030	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:08.358622074 CEST	46030	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:08.359931946 CEST	46030	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:08.365305901 CEST	3778	46030	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:08.365374088 CEST	46030	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:08.370742083 CEST	3778	46030	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:09.196567059 CEST	3778	46030	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:09.196846962 CEST	46030	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:09.196846962 CEST	46030	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:09.197429895 CEST	46032	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:09.202883005 CEST	3778	46032	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:09.202945948 CEST	46032	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:09.203788996 CEST	46032	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:09.209100008 CEST	3778	46032	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:09.209156990 CEST	46032	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:09.214448929 CEST	3778	46032	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:10.032286882 CEST	3778	46032	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:10.032660007 CEST	46032	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:10.032660007 CEST	46032	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:10.033174038 CEST	46034	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:10.038449049 CEST	3778	46034	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:10.038518906 CEST	46034	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:10.039335966 CEST	46034	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:10.044662952 CEST	3778	46034	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:10.044733047 CEST	46034	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:10.050070047 CEST	3778	46034	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:10.868738890 CEST	3778	46034	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:10.869035959 CEST	46034	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:10.869036913 CEST	46034	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:10.869559050 CEST	46036	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:10.874851942 CEST	3778	46036	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:10.874984026 CEST	46036	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:10.876117945 CEST	46036	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:10.881383896 CEST	3778	46036	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:10.881480932 CEST	46036	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:10.886771917 CEST	3778	46036	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:11.701242924 CEST	3778	46036	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:11.701455116 CEST	46036	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:11.701455116 CEST	46036	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:11.702308893 CEST	46038	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:11.707614899 CEST	3778	46038	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:11.707705975 CEST	46038	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:11.708967924 CEST	46038	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:11.714349985 CEST	3778	46038	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:11.714406967 CEST	46038	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:11.719918013 CEST	3778	46038	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:12.547576904 CEST	3778	46038	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:12.547791004 CEST	46038	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:12.547791004 CEST	46038	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:12.548566103 CEST	46040	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:12.553936958 CEST	3778	46040	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:12.554049015 CEST	46040	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:12.555283070 CEST	46040	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:12.560590029 CEST	3778	46040	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:12.560697079 CEST	46040	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:12.566765070 CEST	3778	46040	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:13.384633064 CEST	3778	46040	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:13.384824991 CEST	46040	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:13.384824991 CEST	46040	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:13.385612965 CEST	46042	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:13.390886068 CEST	3778	46042	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:13.390939951 CEST	46042	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:13.392045975 CEST	46042	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:13.397351027 CEST	3778	46042	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:13.397413969 CEST	46042	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:13.402724028 CEST	3778	46042	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:14.214808941 CEST	3778	46042	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:14.214915991 CEST	46042	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:14.215061903 CEST	46042	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:14.215750933 CEST	46044	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:14.221096992 CEST	3778	46044	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:14.221183062 CEST	46044	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:14.222331047 CEST	46044	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:14.227632046 CEST	3778	46044	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:14.227700949 CEST	46044	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:14.233129978 CEST	3778	46044	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:15.052428007 CEST	3778	46044	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:15.052560091 CEST	46044	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:15.052561045 CEST	46044	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:15.053391933 CEST	46046	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:15.058748007 CEST	3778	46046	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:15.058811903 CEST	46046	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:15.059967041 CEST	46046	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:15.065263033 CEST	3778	46046	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:15.065318108 CEST	46046	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:15.070642948 CEST	3778	46046	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:15.891510963 CEST	3778	46046	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:15.891674042 CEST	46046	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:15.891674042 CEST	46046	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:15.892589092 CEST	46048	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:15.898238897 CEST	3778	46048	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:15.898315907 CEST	46048	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:15.899406910 CEST	46048	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:15.904730082 CEST	3778	46048	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:15.904788971 CEST	46048	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:15.910142899 CEST	3778	46048	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:16.729072094 CEST	3778	46048	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:16.729372978 CEST	46048	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:16.729372978 CEST	46048	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:16.731386900 CEST	46050	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:16.736747980 CEST	3778	46050	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:16.736973047 CEST	46050	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:16.738503933 CEST	46050	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:16.743973017 CEST	3778	46050	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:16.744051933 CEST	46050	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:16.749557972 CEST	3778	46050	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:17.579948902 CEST	3778	46050	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:17.580121994 CEST	46050	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:17.580122948 CEST	46050	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:17.582000971 CEST	46052	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:17.587466002 CEST	3778	46052	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:17.587519884 CEST	46052	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:17.589132071 CEST	46052	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:17.594525099 CEST	3778	46052	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:17.594569921 CEST	46052	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:17.599941969 CEST	3778	46052	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:18.436523914 CEST	3778	46052	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:18.436636925 CEST	46052	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:18.436781883 CEST	46052	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:18.437581062 CEST	46054	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:18.442904949 CEST	3778	46054	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:18.442981005 CEST	46054	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:18.444154024 CEST	46054	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:18.449477911 CEST	3778	46054	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:18.449542046 CEST	46054	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:18.454905033 CEST	3778	46054	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:19.274802923 CEST	3778	46054	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:19.274827957 CEST	3778	46054	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:19.274971962 CEST	46054	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:19.274971962 CEST	46054	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:19.274971962 CEST	46054	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:19.276087046 CEST	46056	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:19.281397104 CEST	3778	46056	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:19.281455040 CEST	46056	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:19.282440901 CEST	46056	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:19.287718058 CEST	3778	46056	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:19.287760973 CEST	46056	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:19.293059111 CEST	3778	46056	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:20.113831997 CEST	3778	46056	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:20.113986969 CEST	46056	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:20.113986969 CEST	46056	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:20.115223885 CEST	46058	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:20.120676994 CEST	3778	46058	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:20.120754957 CEST	46058	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:20.122178078 CEST	46058	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:20.127614975 CEST	3778	46058	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:20.127681017 CEST	46058	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:20.132989883 CEST	3778	46058	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:20.962133884 CEST	3778	46058	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:20.962311029 CEST	46058	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:20.962311029 CEST	46058	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:20.963850975 CEST	46060	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:20.969440937 CEST	3778	46060	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:20.969511986 CEST	46060	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:20.971435070 CEST	46060	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:20.976900101 CEST	3778	46060	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:20.977045059 CEST	46060	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:20.982657909 CEST	3778	46060	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:21.803733110 CEST	3778	46060	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:21.804141998 CEST	46060	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:21.804141998 CEST	46060	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:21.806215048 CEST	46062	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:21.811896086 CEST	3778	46062	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:21.812225103 CEST	46062	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:21.813870907 CEST	46062	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:21.819412947 CEST	3778	46062	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:21.819588900 CEST	46062	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:21.825311899 CEST	3778	46062	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:31.820579052 CEST	46062	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 06:59:31.827258110 CEST	3778	46062	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:32.062783003 CEST	3778	46062	79.133.46.243	192.168.2.14
Oct 24, 2024 06:59:32.063358068 CEST	46062	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 07:00:32.113955975 CEST	46062	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 07:00:32.121768951 CEST	3778	46062	79.133.46.243	192.168.2.14
Oct 24, 2024 07:00:32.357620001 CEST	3778	46062	79.133.46.243	192.168.2.14
Oct 24, 2024 07:00:32.357753038 CEST	46062	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 07:01:27.313554049 CEST	45246	53	192.168.2.14	8.8.8.8
Oct 24, 2024 07:01:27.319645882 CEST	53	45246	8.8.8.8	192.168.2.14
Oct 24, 2024 07:01:27.319725037 CEST	45246	53	192.168.2.14	8.8.8.8
Oct 24, 2024 07:01:27.319725037 CEST	45246	53	192.168.2.14	8.8.8.8
Oct 24, 2024 07:01:27.319768906 CEST	45246	53	192.168.2.14	8.8.8.8
Oct 24, 2024 07:01:27.325556993 CEST	53	45246	8.8.8.8	192.168.2.14
Oct 24, 2024 07:01:27.325594902 CEST	53	45246	8.8.8.8	192.168.2.14
Oct 24, 2024 07:01:27.913471937 CEST	53	45246	8.8.8.8	192.168.2.14
Oct 24, 2024 07:01:27.913558960 CEST	45246	53	192.168.2.14	8.8.8.8
Oct 24, 2024 07:01:29.913738966 CEST	53	45246	8.8.8.8	192.168.2.14
Oct 24, 2024 07:01:29.914089918 CEST	45246	53	192.168.2.14	8.8.8.8
Oct 24, 2024 07:01:29.920337915 CEST	53	45246	8.8.8.8	192.168.2.14
Oct 24, 2024 07:01:32.407742977 CEST	46062	3778	192.168.2.14	79.133.46.243
Oct 24, 2024 07:01:32.415113926 CEST	3778	46062	79.133.46.243	192.168.2.14
Oct 24, 2024 07:01:32.650115013 CEST	3778	46062	79.133.46.243	192.168.2.14
Oct 24, 2024 07:01:32.650264978 CEST	46062	3778	192.168.2.14	79.133.46.243

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 24, 2024 07:01:27.319725037 CEST	192.168.2.14	8.8.8.8	0xe090	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 07:01:27.319768906 CEST	192.168.2.14	8.8.8.8	0xd1fc	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 24, 2024 07:01:27.913471937 CEST	8.8.8.8	192.168.2.14	0xe090	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false
Oct 24, 2024 07:01:27.913471937 CEST	8.8.8.8	192.168.2.14	0xe090	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: 3kMnPQIVHR.elf PID: 5555, Parent PID: 5474

General

Start time (UTC):	04:58:42
Start date (UTC):	24/10/2024
Path:	/tmp/3kMnPQIVHR.elf
Arguments:	/tmp/3kMnPQIVHR.elf
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Chronological Activities

Analysis Process: 3kMnPQIVHR.elf PID: 5557, Parent PID: 5555

General

Start time (UTC):	04:58:42
Start date (UTC):	24/10/2024
Path:	/tmp/3kMnPQIVHR.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Chronological Activities

Analysis Process: 3kMnPQIVHR.elf PID: 5558, Parent PID: 5555

General

Start time (UTC):	04:58:42
Start date (UTC):	24/10/2024
Path:	/tmp/3kMnPQIVHR.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Chronological Activities

Analysis Process: 3kMnPQIVHR.elf PID: 5561, Parent PID: 5555

General

Start time (UTC):	04:58:42
Start date (UTC):	24/10/2024
Path:	/tmp/3kMnPQIVHR.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Chronological Activities

Analysis Process: xfce4-panel PID: 5565, Parent PID: 3172

General

Start time (UTC):	04:58:43
Start date (UTC):	24/10/2024
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Chronological Activities

Analysis Process: wrapper-2.0 PID: 5565, Parent PID: 3172

General

Start time (UTC):	04:58:43
Start date (UTC):	24/10/2024
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Chronological Activities

Analysis Process: xfce4-panel PID: 5566, Parent PID: 3172

General

Start time (UTC):	04:58:43
Start date (UTC):	24/10/2024
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Chronological Activities

Analysis Process: wrapper-2.0 PID: 5566, Parent PID: 3172

General

Start time (UTC):	04:58:43
Start date (UTC):	24/10/2024
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Chronological Activities

Analysis Process: xfce4-panel PID: 5567, Parent PID: 3172

General

Start time (UTC):	04:58:43
Start date (UTC):	24/10/2024
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Chronological Activities

Analysis Process: wrapper-2.0 PID: 5567, Parent PID: 3172

General

Start time (UTC):	04:58:43
Start date (UTC):	24/10/2024
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Chronological Activities

Analysis Process: xfce4-panel PID: 5569, Parent PID: 3172

General

Start time (UTC):	04:58:43
Start date (UTC):	24/10/2024
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Chronological Activities

Analysis Process: wrapper-2.0 PID: 5569, Parent PID: 3172

General

Start time (UTC):	04:58:43
Start date (UTC):	24/10/2024
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Chronological Activities

Analysis Process: xfce4-panel PID: 5570, Parent PID: 3172

General

Start time (UTC):	04:58:43
Start date (UTC):	24/10/2024
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Chronological Activities

Analysis Process: wrapper-2.0 PID: 5570, Parent PID: 3172

General

Start time (UTC):	04:58:43
Start date (UTC):	24/10/2024
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Chronological Activities

Analysis Process: xfce4-panel PID: 5571, Parent PID: 3172

General

Start time (UTC):	04:58:43
Start date (UTC):	24/10/2024
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Chronological Activities

Analysis Process: wrapper-2.0 PID: 5571, Parent PID: 3172

General

Start time (UTC):	04:58:43
Start date (UTC):	24/10/2024
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Chronological Activities

Analysis Process: systemd PID: 5618, Parent PID: 1

General

Start time (UTC):	05:00:03
Start date (UTC):	24/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: logrotate PID: 5618, Parent PID: 1

General

Start time (UTC):	05:00:03
Start date (UTC):	24/10/2024
Path:	/usr/sbin/logrotate
Arguments:	/usr/sbin/logrotate /etc/logrotate.conf
File size:	84056 bytes
MD5 hash:	ff9f6831debb63e53a31ff8057143af6

Chronological Activities

Analysis Process: systemd PID: 5619, Parent PID: 1

General

Start time (UTC):	05:00:03
Start date (UTC):	24/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: install PID: 5619, Parent PID: 1

General

Start time (UTC):	05:00:03
Start date (UTC):	24/10/2024
Path:	/usr/bin/install
Arguments:	/usr/bin/install -d -o man -g man -m 0755 /var/cache/man
File size:	158112 bytes
MD5 hash:	55e2520049dc6a62e8c94732e36cdd54

Chronological Activities

Analysis Process: systemd PID: 5677, Parent PID: 1

General

Start time (UTC):	05:00:03
Start date (UTC):	24/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: find PID: 5677, Parent PID: 1

General

Start time (UTC):	05:00:03
Start date (UTC):	24/10/2024
Path:	/usr/bin/find
Arguments:	/usr/bin/find /var/cache/man -type f -name *.gz -atime +6 -delete
File size:	320160 bytes
MD5 hash:	b68ef002f84cc54dd472238ba7df80ab

Chronological Activities

Analysis Process: systemd PID: 5680, Parent PID: 1

General

Start time (UTC):	05:00:04
Start date (UTC):	24/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: mandb PID: 5680, Parent PID: 1

General

Start time (UTC):	05:00:04
Start date (UTC):	24/10/2024
Path:	/usr/bin/mandb
Arguments:	/usr/bin/mandb --quiet
File size:	142432 bytes
MD5 hash:	1dda5ea0027ecf1c2db0f5a3de7e6941

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.
Tactics:	Impact
Data Sources:	Command: Command Execution, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Termination, Service: Service Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report 3kMnPQIVHR.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/var/cache/man/5680

/var/cache/man/cs/5680

/var/cache/man/cs/index.db.I0HcxG

/var/cache/man/da/5680

/var/cache/man/da/index.db.UYMJTI

/var/cache/man/de/5680

/var/cache/man/de/index.db.rgUFIG

/var/cache/man/es/5680

/var/cache/man/es/index.db.3uossF

/var/cache/man/fi/5680

/var/cache/man/fi/index.db.cFlBLG

/var/cache/man/fr.ISO8859-1/5680

/var/cache/man/fr.ISO8859-1/index.db.HdgbZF

/var/cache/man/fr.UTF-8/5680

/var/cache/man/fr.UTF-8/index.db.GnVfhI

/var/cache/man/fr/5680

/var/cache/man/fr/index.db.rDT1KH

/var/cache/man/hu/5680

/var/cache/man/hu/index.db.DYAY7I

/var/cache/man/id/5680

/var/cache/man/id/index.db.iMY09G

/var/cache/man/index.db.0wy8BG

/var/cache/man/it/5680

/var/cache/man/it/index.db.PwsfAI

/var/cache/man/ja/5680

/var/cache/man/ja/index.db.qnlTsG

/var/cache/man/ko/5680

/var/cache/man/ko/index.db.4yz2iI

/var/cache/man/nl/5680

/var/cache/man/nl/index.db.w2nWXG

Linux Analysis Report
3kMnPQIVHR.elf